CVE-2019-17026: Firefox and Thunderbird IonMonkey JIT type confusion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a confirmed in-the-wild exploited type confusion in widely deployed browsers and mail clients, with high CVSS and very high EPSS, though it requires user interaction and patches have long been available.

What it is

Incorrect alias information in the IonMonkey JIT compiler when setting array elements can cause a type confusion in Firefox, Firefox ESR and Thunderbird. Mozilla states it is aware of targeted attacks in the wild abusing this flaw, so it is a real-world exploited browser engine bug rather than a theoretical one.

Impact

An attacker can corrupt object typing in the JIT-compiled code, which in a browser engine typically leads to arbitrary code execution in the context of the affected application. The record does not specify the exact post-exploitation capability beyond code execution potential.

Attack surface

The CVSS vector is network-reachable with no privileges but requires user interaction, consistent with a victim loading crafted web content or a malicious message in the affected browser or mail client. No authentication is needed on the attacker side.

Exploitation

It is listed in CISA KEV with a due date of 2022-05-03, and EPSS gives a 30-day probability of about 0.46 (98.8th percentile). A public exploit reference is tagged Exploit on Packet Storm, and Mozilla confirms targeted in-the-wild attacks.

What to do

• Update Firefox to 72.0.1 or later, Firefox ESR to 68.4.1 or later, and Thunderbird to 68.4.1 or later, or apply the equivalent Ubuntu/Gentoo package updates.
• Inventory endpoints and confirm no Firefox or Thunderbird installs remain below the fixed versions, including ESR channels.
• Where immediate patching is not possible, restrict or disable JavaScript execution in the affected clients as a temporary measure.
• Track the CISA KEV remediation due date and treat any unpatched instance as an active exposure.
• Review mail and web gateway controls for delivery of exploit content targeting these clients.

Detection

• Hunt for Firefox or Thunderbird processes spawning unexpected child processes such as shells or scripting interpreters.
• Monitor for crashes in the IonMonkey JIT or repeated renderer/browser crashes on endpoints running unpatched versions.
• Check endpoint software inventory for Firefox, Firefox ESR and Thunderbird versions below the fixed releases.
• Correlate network or email delivery of known exploit pages with subsequent suspicious process activity on the same host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.