---
id: "CVE-2019-11707"
kind: "vulnerability"
aliases: ["CVE-2019-11707"]
title: "Mozilla Firefox and Thunderbird: Mozilla Firefox and Thunderbird Type Confusion Vulnerability"
severity: "high"
cvss: 8.8
epss: 0.37696
exploited: true
status: "open"
category: "package"
products: [{"name": "Mozilla Firefox and Thunderbird", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["browser", "desktop", "exploited", "firefox", "package", "thunderbird"]
not_affected_if: ["patched-version"]
published_at: "2019-07-23T14:15:15+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-11707", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-11707", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11707", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Mozilla Firefox and Thunderbird: Mozilla Firefox and Thunderbird Type Confusion Vulnerability

Mozilla Firefox and Thunderbird have a type confusion bug in the JavaScript Array.pop handling, reachable by manipulating JavaScript objects. An attacker who lures a user to a crafted page can cause a crash and, per the CISA listing, the flaw is known to be exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Mozilla Firefox and Thunderbird affected ? fixed ?

## How to check

Check the installed Firefox or Thunderbird version under Help/About and compare it with the fixed release in the vendor advisory; the sources do not name the fixed version.

## Fix

Update Firefox and Thunderbird to the latest release per vendor instructions, as CISA requires.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-11707
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2019-11707
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2019-11707

## From the sources

A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_