{"id":"CVE-2019-11707","published":"2019-07-23T14:15:15Z","modified":"2026-06-17T02:13:28Z","title":"Mozilla Firefox and Thunderbird Type Confusion Vulnerability","vendor":"Mozilla","product":"Firefox and Thunderbird","tier":"core","eol":null,"description":{"text":"A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.","provenance":"source","from":"NVD"},"summary":{"text":"A type confusion flaw in Mozilla Firefox and Thunderbird, arising from the handling of JavaScript objects in Array.pop, affects Firefox ESR, Firefox and Thunderbird builds prior to the fixed releases. An attacker who can get a user to visit or interact with crafted content can trigger an exploitable crash over the network, without needing prior authentication.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T04:54:19Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.37951,"percentile":0.98547,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2022-05-23","dueDate":"2022-06-13","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-11707","provenance":"source"},"vulncheckKev":{"dateAdded":"2019-06-18","exploitedFirstSeen":"2019-06-18","ransomware":false,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2019-06-18"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-05-23"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-843","name":"Access of Resource Using Incompatible Type"}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1544386","tags":["Issue Tracking","Permissions Required","Vendor Advisory"]},{"url":"https://security.gentoo.org/glsa/201908-12","tags":["Third Party Advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2019-18/","tags":["Vendor Advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2019-20/","tags":["Vendor Advisory"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1544386","tags":["Issue Tracking","Permissions Required","Vendor Advisory"]},{"url":"https://security.gentoo.org/glsa/201908-12","tags":["Third Party Advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2019-18/","tags":["Vendor Advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2019-20/","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11707","tags":["US Government Resource"]}],"techniques":[{"id":"T1499","name":"Endpoint Denial of Service","tactics":["impact"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: drive-by via malicious web content in browser","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"We are aware of targeted attacks in the wild abusing this flaw","start":147,"end":209}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: exploit executes code in client application","mappingType":"primary_impact","evidence":[{"from":"description","quote":"A type confusion vulnerability can occur when manipulating JavaScript objects","start":0,"end":77}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-3377","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-3377","exploited":true,"exploitedSince":"2022-05-23","provenance":"source"},"exploits":[{"id":47038,"url":"https://www.exploit-db.com/exploits/47038","title":"Mozilla Spidermonkey - IonMonkey 'Array.prototype.pop' Type Confusion","type":"dos","platform":"multiple","date":"2019-06-26","verified":true,"provenance":"source"},{"id":50691,"url":"https://www.exploit-db.com/exploits/50691","title":"Mozilla Firefox 67 - Array.pop JIT Type Confusion","type":"local","platform":"windows","date":"2022-02-02","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2019-06-26"},"pocGithub":{"count":4,"skipped":0,"earliest":"2019-08-18","earliestUrl":"https://github.com/vigneshsrao/CVE-2019-11707","repos":[{"name":"vigneshsrao/CVE-2019-11707","url":"https://github.com/vigneshsrao/CVE-2019-11707","stars":42,"created":"2019-08-18"},{"name":"flabbergastedbd/cve-2019-11707","url":"https://github.com/flabbergastedbd/cve-2019-11707","stars":2,"created":"2020-04-13"},{"name":"CosminGGeorgescu/CVE-2019-11707-PoC","url":"https://github.com/CosminGGeorgescu/CVE-2019-11707-PoC","stars":0,"created":"2026-01-29"},{"name":"G4sp4rCS/CVE-2019-11707-from-an-IonMonkey-type-confusion-to-SYSTEM-","url":"https://github.com/G4sp4rCS/CVE-2019-11707-from-an-IonMonkey-type-confusion-to-SYSTEM-","stars":0,"created":"2026-09-23"}]},"first":{"date":"2019-06-26","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/47038"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1189"],"provenance":"ai"},{"stage":"primary","techniques":["T1203"],"provenance":"ai"},{"stage":"related","techniques":["T1499"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2019-06-18","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"},{"date":"2019-06-26","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-47038); later: PoC-in-GitHub 2019-08-18","url":"https://www.exploit-db.com/exploits/47038","provenance":"source"},{"date":"2019-07-23","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11707","provenance":"source"},{"date":"2022-05-23","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-05-23","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-3377","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Exploit-DB","daysToKev":1035},"priority":{"score":68.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2692 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.71,"detail":"percentile 0.9855"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 Exploit-DB entries; 4 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}