Actively exploited in the wild
Mozilla Firefox and Thunderbird Type Confusion Vulnerability
Mozilla - Firefox and Thunderbird · Listed in the CISA KEV since 2022-05-23. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2019-11707
HighCVSS 8.8KEVSummary
A type confusion vulnerability in the JavaScript engine of Firefox and Thunderbird, caused by issues with Array.pop, can lead to an exploitable crash. Targeted attacks in the wild are known.
Risk Assessment
An attacker could remotely crash the browser or potentially execute arbitrary code, posing a serious risk to users.
Recommendation
Immediately update Firefox and Thunderbird to patched versions.
Other vulnerabilities in Firefox
See all- CVE-2026-84141Critical
Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
- CVE-2026-84140Critical
Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
- CVE-2026-84134Critical
Other issue in the Profile Backup component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
- CVE-2026-84133Critical
Site isolation issue in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
- CVE-2026-84129Critical
The vulnerability concerns a site isolation issue in the DOM: Navigation component in Firefox and Thunderbird. The flaw was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
- CVE-2026-84121Critical
Sandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
- CVE-2026-84119Critical
Sandbox escape vulnerability due to use-after-free in the DOM: Navigation component. Fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
- CVE-2026-75874Critical
Sandbox escape in the Remote Settings Client component. Fixed in Firefox 154, Thunderbird 154, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 140.15, and Thunderbird 153.2.
- CVE-2026-74986Critical
Site isolation issue in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
- CVE-2026-74985Critical
Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
Original NVD description (English source)
A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.