Mozilla · Firefox and Thunderbird
CVE-2019-17026
Mozilla Firefox And Thunderbird Type Confusion Vulnerability
What it is
Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox < 72.0.1.
CISA: Mozilla Firefox and Thunderbird contain a type confusion vulnerability due to incorrect alias information in the IonMonkey JIT compiler when setting array elements.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 3, 2022
- Added to the CISA list
- November 3, 2021
- Published
- March 2, 2020
- Severity
- High 8.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 46% in the top 1.2% of all known vulnerabilities
- Weakness
- CWE-843
- More details
- NVD · CVE.org · CISA
All references (6)
- https://security.gentoo.org/glsa/202003-02
- https://usn.ubuntu.com/4335-1/
- https://www.mozilla.org/security/advisories/mfsa2020-04/
- https://www.mozilla.org/security/advisories/mfsa2020-03/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1607443
- http://packetstormsecurity.com/files/162568/Firefox-72-IonMonkey-JIT-Type-Confusion.html
More exploited flaws from Mozilla
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| May 23, 2022 | Type Confusion | Firefox and Thunderbird | High 8.8 | 38% |
| May 23, 2022 | Sandbox Escape | Firefox and Thunderbird | Critical 10.0 | 56% |
| Mar 28, 2022 | Denial-of-Service | Firefox and Thunderbird | High 8.8 | 69% |
| Nov 3, 2021 | Use-After-Free | Firefox and Thunderbird | High 8.1 | 3.0% |
| Nov 3, 2021 | Use-After-Free | Firefox and Thunderbird | High 8.1 | 7.1% |
| Oct 6, 2025 | Remote Code Execution | Multiple Products | Critical 9.8 | 83% |
| Oct 15, 2024 | Use-After-Free | Firefox | Critical 9.8 | 23% |
| Jun 22, 2023 | Use-After-Free | Firefox, Firefox ESR, and Thunderbird | High 7.5 | 87% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.