ZeroDay Findings
Sign inSign up

Findings

CVE-2019-11707

Mozilla Firefox and Thunderbird Type Confusion Vulnerability

Published Jul 23, 2019 · updated Jun 16, 2026 · mozilla firefox

A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.

Timeline

Detection, updates, and resolution for this record.

  1. Jul 23, 2019 · Catalog

    Detected

    A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.

  2. May 23, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Jun 13, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.

Required action

Apply updates per vendor instructions.

CISA due date Jun 13, 2022

Affected

  • cpe mozilla/firefoxversion unspecified
  • cpe mozilla/thunderbirdversion unspecified
  • vendor Mozilla Firefox and Thunderbirdversion unspecified

Sources

  • CISA KEVCVE-2019-11707

    Mozilla Firefox and Thunderbird contain a type confusion vulnerability that can occur when manipulating JavaScript objects due to issues in Array.pop, allowing for an exploitable crash.

    cisa.gov
  • CVE.orgCVE-2019-11707

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2019-11707

    30-day exploitation probability 37.7%

    first.org
  • Exploit Database47038

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit Database50691

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • NIST NVDCVE-2019-11707

    A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, an

    nvd.nist.gov

References