CVE-2019-11716

Until explicitly accessed by script, window.globalThis is not enumerable and, as a result, is not visible to code such as Object.getOwnPropertyNames(window)

published July 23, 2019

CVSS
—
EPSS
1%
Percentile
71.4
In the wild
Unconfirmed
What it is

Until explicitly accessed by script, window.globalThis is not enumerable and, as a result, is not visible to code such as Object.getOwnPropertyNames(window). Sites that deploy a sandboxing that depends on enumerating and freezing access to the window object may miss this, allowing their sandboxes to be bypassed. This vulnerability affects Firefox < 68.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01354 · 71.4th percentile
Published
2019-07-23T13:18Z
EPSS history
Timeline
  • 23 JUL 13:18Z
    Until explicitly accessed by script, window.globalThis is not enumerable and, as a result, is not visible to code such as Object.getOwnPropertyNames(window)
    cvelistv5