CVE-2019-17026
ENISA EUVD: EUVD-2019-7500 ↗
Exploited in the Wild
✓ Confirmed 0-Day
★ Google Project Zero
Triaged: March 3, 2026
2 articles
Published: 2020-03-02
EPSS Score
Source: FIRST.org · 2026-05-23
59.07%
probability
This CVE has a 59.07% probability
of being exploited in the next 30 days.
0%
Top 98.3th percentile of all CVEs
100%
CVSS v3.1
Source: VulnerabilityLookup (CIRCL)8.8
HIGH
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2 (legacy)
6.8
MEDIUM
Access Vector
Network
Access Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
AV:N/AC:M/Au:N/C:P/I:P/A:P
Description
VulnerabilityLookup (CNA)Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox < 72.0.1.
Affected Products
Mozilla
Firefox ESR
unspecified
Mozilla
Thunderbird
unspecified
Mozilla
Firefox
unspecified
Attack Intelligence
Google Project Zero
Discovered
Jan. 7, 2020
Patched
Jan. 8, 2020
Reported by
Qihoo 360 ATA
Root Cause Analysis
https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2020/CVE-2019-17026.html
Exploits & PoC
maxpl0it/CVE-2019-17026-Exploit
An exploit for CVE-2019-17026. It pops xcalc and was tested on Ubuntu (x64).
47
2020-08-27
3
2021-02-24
2 repos — triés par ⭐
Rechercher sur GitHub ↗
https://www.mozilla.org/security/advisories/mfsa2020-04/
x_refsource_MISC
https://www.mozilla.org/security/advisories/mfsa2020-03/
x_refsource_MISC
https://bugzilla.mozilla.org/show_bug.cgi?id=1607443
x_refsource_MISC
https://security.gentoo.org/glsa/202003-02
vendor-advisory
x_refsource_GENTOO
https://usn.ubuntu.com/4335-1/
vendor-advisory
x_refsource_UBUNTU
Signal Intelligence
Confidence
92%
EPSS
59.07%
CVSS v3.1
8.8
Mentions
2
Last Seen
Jan 10, 2020
CNA Information
CNA Assigner
mozilla
Analyst Note
CVE-2019-17026 is a confirmed high-severity type confusion vulnerability in Firefox's IonMonkey JIT compiler with documented active exploitation in the wild, corroborated by Google Project Zero inclusion and CERT-EU critical advisory coverage. The vulnerability affected multiple Mozilla products with specific patched versions identified (Firefox ESR 68.4.1+, Firefox 72.0.1+), providing strong evidence of real-world impact and remediation.
Triage Info
Decided atMar 03, 2026
Published DateMar 02, 2020