CVE-2019-9792: Mozilla Firefox

Critical severity, CVSS 9.8. EPSS: 13.2% chance of exploitation in the next 30 days.

The IonMonkey just-in-time (JIT) compiler can leak an internal JS_OPTIMIZED_OUT magic value to the running script during a bailout. This magic value can then be used by JavaScript to achieve memory corruption, which results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.

Affected products

• Mozilla Firefox: before 60.6.0 (fixed in 60.6.0); before 66.0 (fixed in 66.0)
• Mozilla Thunderbird: before 60.6.0 (fixed in 60.6.0)
• Red Hat Enterprise Linux: version 8.0 only
• Red Hat Enterprise Linux Eus: version 8.1 only; version 8.2 only; version 8.4 only
• Red Hat Enterprise Linux Server Aus: version 8.2 only; version 8.4 only
• Red Hat Enterprise Linux Server Tus: version 8.2 only; version 8.4 only

Published 2019-04-26. Last modified 2026-06-17.