CVE-2019-9803

HIGH 7.4CVE-2019-9803 · Published 26/04/2019 · updated 17/06/2026

In short

CVE-2019-9803 is a HIGH (CVSS 7.4) vulnerability affecting firefox (mozilla).
Chance of exploitation in the next 30 days (EPSS): 0.56%, higher than 46.7% of all vulnerabilities.
Fix: update to 66.0 or later.

Package	Affected versions	Patched versions
firefox mozilla	`< 66.0`	`66.0`

Description

The Upgrade-Insecure-Requests (UIR) specification states that if UIR is enabled through Content Security Policy (CSP), navigation to a same-origin URL must be upgraded to HTTPS. Firefox will incorrectly navigate to an HTTP URL rather than perform the security upgrade requested by the CSP in some circumstances, allowing for potential man-in-the-middle attacks on the linked resources. This vulnerability affects Firefox < 66.

References

bugzilla.mozilla.org/show_bug.cgi · Issue Tracking
bugzilla.mozilla.org/show_bug.cgi · Issue Tracking
w3c.github.io/webappsec-upgrade-insecure-requests · Third Party Advisory
mozilla.org/security/advisories/mfsa2019-07 · Vendor Advisory

More vulnerabilities in firefox

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

firefox

mozilla

< 66.0

66.0

Description

More vulnerabilities in firefox

See all →