CVE-2019-17026

CVE-2019-17026 is a type confusion vulnerability (CWE-843) in the IonMonkey just-in-time (JIT) compiler of Mozilla's SpiderMonkey JavaScript engine, caused by incorrect alias information when setting array elements. It is triggered by attacker-controlled JavaScript, typically a malicious web page opened in Firefox or hostile scripted/remote content rendered by a Thunderbird message, which drives the miscompiled code path and corrupts memory in the JavaScript engine. As is typical for JIT type-confusion bugs in browsers, successful exploitation can lead to arbitrary code execution with the privileges of the signed-in user. Anyone running an affected Firefox or Thunderbird release is exposed, including enterprise deployments where Thunderbird renders untrusted email content. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2021-11-03, confirming in-the-wild exploitation (EPSS 46.6%, 99th percentile), though no public proof-of-concept is known.

What to do: Upgrade Firefox to 71.0 or later (or ESR 68.3 or later) and Thunderbird to 68.3 or later, per Mozilla's December 2019 advisories, and verify installed versions in each product's About dialog. Because the flaw is on CISA's KEV list, federal agencies are required to apply the vendor updates promptly; there is no practical configuration mitigation beyond upgrading, though disabling the JIT via about:config is possible for users who cannot patch immediately.