Mozilla patches actively exploited Firefox zero-day

CVE-2019-11708 is an improper input-validation flaw (CWE-20) in the inter-process communication between Mozilla Firefox and Thunderbird's sandboxed child processes and the non-sandboxed parent process: parameters sent with the Prompt:Open IPC message are not sufficiently vetted. A compromised child process can therefore direct the non-sandboxed parent process to open attacker-chosen web content, escaping the sandbox; when chained with additional vulnerabilities this can result in arbitrary code execution on the user's computer. Anyone running Firefox < 67.0.4, Firefox ESR < 60.7.2, or Thunderbird < 60.7.2 is affected. The flaw was exploited as a zero-day in targeted attacks before the June 2019 fixes (per vendor advisories and news coverage), is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-05-23), and EPSS assigns a 55.9% probability of exploitation within 30 days (99th percentile). No public proof-of-concept is known, but the severity (CVSS 10.0), the sandbox scope change, and the KEV listing indicate high practical risk.

Do: Upgrade Firefox to 67.0.4 or later, Firefox ESR to 60.7.2 or later, and Thunderbird to 60.7.2 or later, per the vendor advisories and CISA KEV required action. Because the sandbox escape on its own only opens attacker-chosen content and must be chained with an additional vulnerability for code execution, also confirm that companion content-processing fixes released at the same time (per the 'second 0-day' coverage) are applied on the same hosts. Inventory endpoints for outdated Firefox/Thunderbird versions and prioritize patching internet-facing and targeted user populations.

CVE-2019-17026 is a type confusion vulnerability (CWE-843) in the IonMonkey just-in-time (JIT) compiler of Mozilla's SpiderMonkey JavaScript engine, caused by incorrect alias information when setting array elements. It is triggered by attacker-controlled JavaScript, typically a malicious web page opened in Firefox or hostile scripted/remote content rendered by a Thunderbird message, which drives the miscompiled code path and corrupts memory in the JavaScript engine. As is typical for JIT type-confusion bugs in browsers, successful exploitation can lead to arbitrary code execution with the privileges of the signed-in user. Anyone running an affected Firefox or Thunderbird release is exposed, including enterprise deployments where Thunderbird renders untrusted email content. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2021-11-03, confirming in-the-wild exploitation (EPSS 46.6%, 99th percentile), though no public proof-of-concept is known.

Do: Upgrade Firefox to 71.0 or later (or ESR 68.3 or later) and Thunderbird to 68.3 or later, per Mozilla's December 2019 advisories, and verify installed versions in each product's About dialog. Because the flaw is on CISA's KEV list, federal agencies are required to apply the vendor updates promptly; there is no practical configuration mitigation beyond upgrading, though disabling the JIT via about:config is possible for users who cannot patch immediately.