Mozilla · Firefox and Thunderbird
CVE-2019-11707
Mozilla Firefox and Thunderbird Type Confusion Vulnerability
What it is
A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.
CISA: Mozilla Firefox and Thunderbird contain a type confusion vulnerability that can occur when manipulating JavaScript objects due to issues in Array.pop, allowing for an exploitable crash.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: June 13, 2022
More exploited flaws from Mozilla
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| May 23, 2022 | Sandbox Escape | Firefox and Thunderbird | Critical 10.0 | 56% |
| Mar 28, 2022 | Denial-of-Service | Firefox and Thunderbird | High 8.8 | 69% |
| Nov 3, 2021 | Use-After-Free | Firefox and Thunderbird | High 8.1 | 3.0% |
| Nov 3, 2021 | Use-After-Free | Firefox and Thunderbird | High 8.1 | 7.1% |
| Nov 3, 2021 | Type Confusion | Firefox and Thunderbird | High 8.8 | 46% |
| Oct 6, 2025 | Remote Code Execution | Multiple Products | Critical 9.8 | 83% |
| Oct 15, 2024 | Use-After-Free | Firefox | Critical 9.8 | 23% |
| Jun 22, 2023 | Use-After-Free | Firefox, Firefox ESR, and Thunderbird | High 7.5 | 87% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.