CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2019-11707
High (8.8) in Mozilla Firefox and Thunderbird. In CISA KEV since 2022-05-23. EPSS 38% chance of exploitation in the next 30 days.
A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.
Severity
- EPSS
- 38% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
- CISA KEV
- listed 2022-05-23, due 2022-06-13
- CWE
- CWE-843
- Published
- Modified
- Record from
- the NVD, synced
Affected
- mozilla:firefox
- mozilla:thunderbird