CVE-2019-9813: Mozilla Firefox

High severity, CVSS 8.8. EPSS: 7.4% chance of exploitation in the next 30 days.

Incorrect handling of __proto__ mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arbitrary memory read and write. This vulnerability affects Firefox < 66.0.1, Firefox ESR < 60.6.1, and Thunderbird < 60.6.1.

Affected products

• Mozilla Firefox: before 60.6.1 (fixed in 60.6.1); before 66.0.1 (fixed in 66.0.1)
• Mozilla Thunderbird: before 60.6.1 (fixed in 60.6.1)

Published 2019-04-26. Last modified 2026-06-17.