CVE-2019-17026
Mozilla Firefox And Thunderbird Type Confusion Vulnerability
Description
CVE-2019-17026 is a high-severity type confusion vulnerability in Mozilla Firefox and Thunderbird. Incorrect alias information in the IonMonkey JIT compiler when setting array elements can lead to a type confusion, potentially allowing attackers to execute arbitrary code. Mozilla has confirmed awareness of targeted attacks in the wild exploiting this flaw. CISA has listed CVE-2019-17026 in its Known Exploited Vulnerabilities catalog, and with an EPSS score of 64.8% (98.4th percentile), this vulnerability has a very high probability of active exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| mozilla | firefox | < 68.4.1; < 72.0.1 |
| mozilla | thunderbird | < 68.4.1 |
| canonical | ubuntu linux | 16.04 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/162568/Firefox-72-IonMonkey-JIT-Type-Confusion.html(Exploit, Third Party Advisory, VDB Entry)
- https://bugzilla.mozilla.org/show_bug.cgi?id=1607443(Issue Tracking)
- https://security.gentoo.org/glsa/202003-02(Third Party Advisory)
- https://usn.ubuntu.com/4335-1/(Third Party Advisory)
- https://www.mozilla.org/security/advisories/mfsa2020-03/(Vendor Advisory)
- https://www.mozilla.org/security/advisories/mfsa2020-04/(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-17026(US Government Resource)
Weakness Type
CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
CWE-843 describes a type confusion vulnerability where a program accesses a resource using a type that is incompatible with its actual type. In CVE-2019-17026, the IonMonkey JIT compiler in Firefox and Thunderbird uses incorrect alias information when setting array elements, causing the engine to treat data as an incompatible type. This type confusion can corrupt memory and allow an attacker to achieve code execution.
Learn more: CWE-843 — Access of Resource Using Incompatible Type ('Type Confusion')
Impact Analysis
CVE-2019-17026 has a CVSS 3.1 score of 8.8 (HIGH), reflecting a serious security threat. The vulnerability is remotely exploitable over the network with low attack complexity and requires no authentication, though user interaction is required (such as visiting a malicious webpage). Confidentiality (High): Successful exploitation can expose all data accessible to the browser process, including session tokens, credentials, and browsing data. Integrity (High): An attacker can modify memory contents and potentially install malicious code or alter browser behavior. Availability (High): Exploitation can crash the browser or render it completely unavailable. The EPSS score of 64.8% places this vulnerability in the 98.4th percentile, indicating an extremely high probability of exploitation, making it one of the most likely-to-be-exploited vulnerabilities in the ecosystem.
Exploit Maturity
CVE-2019-17026 has confirmed active exploitation in the wild, as acknowledged by Mozilla and verified through its inclusion in the CISA Known Exploited Vulnerabilities catalog. Public exploit code is available for CVE-2019-17026 via Packet Storm Security, which significantly lowers the barrier for attackers. The EPSS score of 64.8% (98.4th percentile) indicates near-certain exploitation activity, placing this among the most actively targeted vulnerabilities. Federal agencies were required to remediate this vulnerability by 2022-05-03 per CISA's binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Update Mozilla Firefox to version 72.0.1 or later, Firefox ESR to version 68.4.1 or later, and Thunderbird to version 68.4.1 or later.
- Audit all deployed instances of Firefox and Thunderbird across the organization to confirm that patched versions are installed, paying special attention to Firefox ESR deployments in enterprise environments.
- If immediate patching is not feasible, disable or restrict JavaScript execution through browser policies or security extensions to mitigate JIT compiler exploitation, and limit access to untrusted websites through URL filtering or web proxy configuration.
- Monitor browser process behavior for indicators of exploitation, including unexpected crashes in IonMonkey JIT-compiled code, unusual memory allocation patterns, and suspicious child process creation.
- Conduct a retrospective security review to determine whether this vulnerability was exploited prior to patching, particularly given the confirmed targeted attacks, and review endpoint detection logs for any anomalous browser activity.
Technical Details
CVE-2019-17026 is a type confusion vulnerability (CWE-843) in the IonMonkey JIT compiler used by Mozilla Firefox and Thunderbird. The flaw originates from incorrect alias information maintained by the JIT compiler when setting array elements, which causes the engine to incorrectly infer the type of an array element. When the JIT-optimized code subsequently accesses this element, it uses the wrong type assumptions, leading to a type confusion where memory is interpreted as an incompatible data structure. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates that exploitation requires a user to visit a crafted webpage containing malicious JavaScript, but once triggered the attack complexity is low and no privileges are required. The type confusion can be leveraged to achieve arbitrary read/write primitives in memory, ultimately enabling full remote code execution within the browser's content process.
Frequently Asked Questions
Is CVE-2019-17026 being actively exploited?
Yes. Mozilla has confirmed targeted attacks in the wild exploiting CVE-2019-17026, and CISA has added it to the Known Exploited Vulnerabilities catalog. Public exploit code is also available, and the EPSS score of 64.8% (98.4th percentile) indicates extremely high exploitation probability.
What products are affected by CVE-2019-17026?
CVE-2019-17026 affects Mozilla Firefox versions prior to 72.0.1, Firefox ESR versions prior to 68.4.1, and Mozilla Thunderbird versions prior to 68.4.1. Canonical Ubuntu Linux 16.04 is also listed as affected due to bundled Firefox packages.
How do I fix CVE-2019-17026?
Update Mozilla Firefox to version 72.0.1 or later, Firefox ESR to 68.4.1 or later, and Thunderbird to 68.4.1 or later. If patching is not immediately possible, restrict JavaScript execution and limit access to untrusted web content.
How severe is CVE-2019-17026?
CVE-2019-17026 has a CVSS 3.1 score of 8.8 (HIGH). Combined with an EPSS score in the 98.4th percentile and confirmed active exploitation, this is a critical-priority vulnerability requiring immediate remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.