CVE-2019-11707: Mozilla Firefox and Thunderbird Type Confusion Vulnerability

Overview Sources History

What happened

Mozilla Firefox and Thunderbird contain a type confusion vulnerability that can occur when manipulating JavaScript objects due to issues in Array.pop, allowing for an exploitable crash.

Affected versions

Firefox and Thunderbird: See original advisory Fixed: See vendor advisory.

Why it matters

This source correlation may provide earlier visibility while structured CVE metadata is still being updated.

Detection & mitigation

Review the original advisory and validate affected versions.
Apply vendor-provided updates or mitigations when available.

Public PoC references

RepositoryAuthorFirst seenReference

Exploit-DB 47038Mozilla Spidermonkey - IonMonkey 'Array.prototype.pop' Type ConfusionGoogle Security Research2019-06-26Verified Exploit-DB 50691Mozilla Firefox 67 - Array.pop JIT Type ConfusionForrest Orr2022-02-02Verified PoC-in-GitHub · vigneshsrao/CVE-2019-11707Exploit code for CVE-2019-11707 on Firefox 66.0.3 running on Ubuntu★ 42vigneshsrao2019-08-18Candidate PoC-in-GitHub · flabbergastedbd/cve-2019-11707https://bugs.chromium.org/p/project-zero/issues/detail?id=1820★ 2flabbergastedbd2020-04-13Candidate PoC-in-GitHub · CosminGGeorgescu/CVE-2019-11707-PoCProof of concept for CVE-2019-11707★ 0CosminGGeorgescu2026-01-29Candidate PoC-in-GitHub · G4sp4rCS/CVE-2019-11707-from-an-IonMonkey-type-confusion-to-SYSTEM-CVE-2019-11707 is a critical type confusion in Firefox's IonMonkey optimizing JIT. The browser bug provides native code execution in the content process, but that process remains constrained by the Firefox sandbox. The complete laboratory chain therefore combines three vulnerabilities:★ 0G4sp4rCS2026-09-23Candidate

Corrections Report an issue

Mozilla Firefox and Thunderbird Type Confusion Vulnerability