Mozilla Firefox and Thunderbird Array.pop Type Confusion Remote Code Execution Vulnerability (CVE-2019-11707)

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2019-11707) is a critical type confusion vulnerability (CWE-843) residing in Mozilla's Spidermonkey JavaScript engine during the handling of Array.pop operations. To optimize execution speed, the JIT (Just-In-Time) compiler makes assumptions about the types of objects in a layout. However, due to a logical flaw in how Array.pop manipulates array elements, the engine fails to properly validate the object type after modification. This leads to a mismatch between the assumed type and the actual memory layout of the object.

2. Exploitation Mechanics & Attack Scenario

An attacker can exploit this vulnerability by enticing a user to visit a malicious website or open a specially crafted HTML email. When the JIT compiler optimizes the code containing Array.pop, the attacker triggers a type confusion by dynamically altering the array's structure or prototype chain. This allows the attacker to bypass memory safety protections, achieving arbitrary memory read/write primitives. Ultimately, this primitive is leveraged to execute arbitrary shellcode within the context of the browser process, often chained with a sandbox escape to compromise the host operating system.

3. Infrastructure & Business Impact

As a CISA KEV-listed vulnerability with an EPSS score of 0.3795, this flaw has been actively exploited in targeted attacks in the wild. In an enterprise environment, a single employee visiting an untrusted site using an unpatched browser can lead to complete endpoint compromise. This poses a severe threat to business continuity, potentially serving as an initial entry point for ransomware deployment, lateral movement, and sensitive data exfiltration.