CVE-2019-11707

What is Firefox's JavaScript engine?

Firefox's SpiderMonkey JavaScript engine parses and executes the script on every web page a user visits, making it one of the largest and most exposed pieces of attack surface in a widely deployed browser. Because JavaScript execution happens automatically just by visiting a page, memory-safety bugs in the engine are prized by attackers as reliable, low-interaction remote code execution primitives — especially valuable for targeted spear-phishing campaigns against specific individuals.

Overview

CVE-2019-11707 is a type confusion vulnerability in Firefox and Thunderbird's handling of Array.prototype.pop, discovered being actively exploited in the wild as a zero-day in June 2019. The bug allows a maliciously crafted web page to trigger memory corruption inside the content-process JavaScript engine, providing an initial code-execution primitive within Firefox's sandboxed renderer process. On its own it does not escape the sandbox, but it was used together with CVE-2019-11708 (a separate sandbox-escape bug) to achieve full remote code execution outside the browser's security boundary.

Technical Details

The flaw (CWE-843, type confusion) occurs when manipulating a JavaScript array via Array.pop, where certain code paths cause the engine to misinterpret the type of an object it manipulates, treating memory as a different type than it actually is. An attacker who controls the array's state at the moment of confusion can corrupt the JavaScript heap in a way that leads to an exploitable crash, and with careful heap grooming, arbitrary read/write primitives that support further exploitation. It requires a victim to visit or be lured to a malicious web page (user interaction) but no privileges and works purely over the network via ordinary web browsing.

Discovery

The exploitation was first surfaced by Coinbase's security team (led by Philip Martin), which detected a targeted spear-phishing campaign against Coinbase employees using a malicious link that triggered this Firefox zero-day. Mozilla, working with Coinbase and independently with Samuel Groß of Google's Project Zero (who had separately found and reported the same bug), shipped an emergency Firefox update within roughly 24 hours of the report.

Exploitation Context

This vulnerability was confirmed used in the wild before a patch existed, specifically in a campaign targeting cryptocurrency-exchange employees at Coinbase; researchers and reporting at the time loosely associated the activity with North Korea-linked threat actors interested in cryptocurrency theft, consistent with that group's other known targeting of exchanges. It was chained with the sandbox-escape bug CVE-2019-11708 to achieve full, unsandboxed remote code execution against targeted individuals rather than being deployed as a broad, opportunistic campaign.

Remediation

1. Update Firefox to 67.0.3 or later (and Firefox ESR to 60.7.1 or later), and Thunderbird to a version incorporating the fix.
2. Ensure browsers auto-update is enabled organization-wide so emergency zero-day patches reach endpoints within hours, not weeks.
3. For high-value targets (finance, cryptocurrency, executives), consider additional email/link-scanning controls given this bug's history of use in targeted spear-phishing.
4. Apply the companion fix for CVE-2019-11708, since the two were chained together for real-world exploitation.
5. Review endpoint and email security logs from mid-June 2019 for indicators of this campaign if the organization operated in a high-risk sector during that period.