CVE-2019-17026

HIGH KEV

Firefox < 72.0.1 and Firefox ESR < 68.4.1 - Type Confusion in IonMonkey JIT Compiler

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2019-17026 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021. EIP tracks 3 public exploits from researchers including Forrest Orr, maxpl0it, lsw29475.

AI-analyzed exploit summary This exploit leverages a type confusion bug in Firefox's IonMonkey JIT engine (CVE-2019-17026) to achieve remote code execution. It employs a two-stage shellcode approach with an egg hunter to bypass DEP and ASLR, targeting Firefox versions < 72 on Windows systems.

Description

Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox < 72.0.1.

Exploits (3)

exploitdb WORKING POC
by Forrest Orr · javascriptlocalwindows_x86-64
https://www.exploit-db.com/exploits/49864

This exploit leverages a type confusion bug in Firefox's IonMonkey JIT engine (CVE-2019-17026) to achieve remote code execution. It employs a two-stage shellcode approach with an egg hunter to bypass DEP and ASLR, targeting Firefox versions < 72 on Windows systems.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: Mozilla Firefox < 72 (64-bit)
No auth needed
Prerequisites: Vulnerable Firefox version (< 72) on Windows · User interaction (visiting a malicious webpage)
mistral-large-3 · analyzed Feb 16, 2026 Full analysis →
nomisec WRITEUP 47 stars
by maxpl0it · client-side
https://github.com/maxpl0it/CVE-2019-17026-Exploit

This repository provides a technical summary and references for CVE-2019-17026, a Firefox JIT bug involving IonMonkey type confusion with StoreElementHole and FallibleStoreElement. It includes details about the vulnerability, affected versions, and a link to a comprehensive writeup.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Complex
Reliability
Theoretical
Target: Firefox < 72.0.1
No auth needed
Prerequisites: Firefox < 72.0.1 · Sandbox disabled (security.sandbox.content.level set to 0)
mistral-large-3 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 3 stars
by lsw29475 · client-side
https://github.com/lsw29475/CVE-2019-17026

This repository contains a functional exploit for CVE-2019-17026, leveraging a type confusion vulnerability in V8's TurboFan optimizer to achieve arbitrary memory read/write and execute shellcode. The exploit includes helper utilities for memory manipulation and shellcode execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: Google Chrome V8 Engine (versions prior to fix)
No auth needed
Prerequisites: Victim must visit a malicious webpage or execute the JavaScript in a vulnerable Chrome instance
mistral-large-3 · analyzed Feb 18, 2026 Full analysis →

References (7)

Core 7
Core References
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/202003-02
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/4335-1/
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/162568/Firefox-72-IonMonkey-JIT-Type-Confusion.html

Scores

CVSS v3 8.8
EPSS 0.4368
EPSS Percentile 98.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2021-11-03
VulnCheck KEV 2020-01-07
InTheWild.io 2020-01-07
ENISA EUVD EUVD-2019-7500
CWE
CWE-843
Status published
Products (4)
canonical/ubuntu_linux 16.04
mozilla/firefox < 68.4.1
mozilla/firefox < 72.0.1
mozilla/thunderbird < 68.4.1
Published Mar 02, 2020
KEV Added Nov 03, 2021
Tracked Since Feb 18, 2026