CVE-2019-17026
Mozilla Firefox And Thunderbird Type Confusion Vulnerability
Published Mar 1, 2020 · updated Jun 16, 2026 · mozilla firefox
Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox < 72.0.1.
Timeline
Detection, updates, and resolution for this record.
Mar 1, 2020 · Catalog
Detected
Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox < 72.0.1.
Nov 3, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
May 3, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox < 72.0.1.
Required action
Apply updates per vendor instructions.
CISA due date May 3, 2022
Affected
- cpe canonical/ubuntu linux16.04
- cpe mozilla/firefoxversion unspecified
- cpe mozilla/thunderbirdversion unspecified
- vendor Mozilla Firefox and Thunderbirdversion unspecified
Sources
- CISA KEVCVE-2019-17026
Mozilla Firefox and Thunderbird contain a type confusion vulnerability due to incorrect alias information in the IonMonkey JIT compiler when setting array elements.
cisa.gov - CVE.orgCVE-2019-17026
Official CVE identifier
cve.org - FIRST EPSSCVE-2019-17026
30-day exploitation probability 46.3%
first.org - Exploit Database49864
Public archive entry. The exploit body is not stored here.
exploit-db.com - NIST NVDCVE-2019-17026
Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox < 72.0.1.
nvd.nist.gov