CVE-2019-11707: Mozilla Firefox and Thunderbird Array.pop type confusion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a remotely reachable, memory-corruption flaw with confirmed in-the-wild exploitation and a high EPSS score, though it requires user interaction and patches have long been available.

What it is

A type confusion flaw in JavaScript Array.pop handling lets a crafted script corrupt object types in the browser engine, producing an exploitable crash. Mozilla confirmed targeted attacks in the wild, and the flaw affects Firefox ESR before 60.7.1, Firefox before 67.0.3, and Thunderbird before 60.7.2.

Impact

An attacker who lands the crafted JavaScript can corrupt memory and potentially execute code in the context of the affected application. At minimum, the flaw yields a reliable crash of the browser or mail client.

Attack surface

Reached over the network through web content or email-rendered JavaScript; the CVSS vector requires user interaction (UI:R) and no privileges (PR:N), so a victim must load the malicious page or message.

Exploitation

CISA KEV lists it as exploited in the wild since 2022-05-23, and EPSS is 0.377 (98th percentile), indicating high real-world exploitation activity.

What to do

• Update Firefox to 67.0.3 or later, Firefox ESR to 60.7.1 or later, and Thunderbird to 60.7.2 or later.
• Apply the vendor advisories mfsa2019-18 and mfsa2019-20 and any downstream distribution patches such as Gentoo GLSA 201908-12.
• Enforce automatic updates for browsers and mail clients so affected versions are not left in place.
• Restrict or disable JavaScript in high-risk browsing and mail-reading contexts where feasible.

Detection

• Hunt for crashes of firefox, firefox-esr, or thunderbird processes and correlate with visits to untrusted sites or opened messages.
• Monitor for known exploit indicators tied to CVE-2019-11707 in web proxy, IDS, or endpoint telemetry.
• Check asset inventories for Firefox, Firefox ESR, and Thunderbird versions below the fixed releases.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.