CISA KEV catalog
Confirmed active exploitation.
Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.
- Name
- Mozilla Firefox and Thunderbird Type Confusion Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.
Affected products
mozilla: firefox; mozilla: thunderbird
References9
- bugzilla.mozilla.org/show_bug.cgi?id=1544386 Issue TrackingPermissions RequiredVendor Advisory
- www.mozilla.org/security/advisories/mfsa2019-18/ Vendor Advisory
- www.mozilla.org/security/advisories/mfsa2019-20/ Vendor Advisory
- bugzilla.mozilla.org/show_bug.cgi?id=1544386 Issue TrackingPermissions RequiredVendor Advisory
- www.mozilla.org/security/advisories/mfsa2019-18/ Vendor Advisory
- www.mozilla.org/security/advisories/mfsa2019-20/ Vendor Advisory
- security.gentoo.org/glsa/201908-12 Third Party Advisory
- security.gentoo.org/glsa/201908-12 Third Party Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=… US Government Resource
Metrics
- CVSS 3.1
-
8.8
HIGH
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 38% percentile: 99 · as of 10 November 2026
- CWE
- CWE-843
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.