# CVE-2019-11707: IonMonkey Type Confusion in Array.Pop

Firefox IonMonkey JIT failed to guard Array.prototype.pop against prototype accessors, enabling type confusion to arbitrary read/write, exploited in the wild.

- Payout: Real-world hack
- Severity: critical
- Program: Mozilla Firefox
- Credited: Samuel Groß, Project Zero (Originally posted on [Project Zero blog](https://googleprojectzero.blogspot.com/p/rca.html) 2020-07-27)
- Disclosed: 2019-06-18
- CVE: CVE-2019-11707
- Write-up quality: 7/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2019/CVE-2019-11707.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2019-11707
- Tags: domain:browser impact:rce kind:incident platform:project-zero sev:critical tech:firefox technique:fuzzing technique:source-review vuln:memory-corruption

**Target:** SpiderMonkey IonMonkey JIT compiler
**Root cause:** JIT failed to ensure Array.prototype.pop would not load an element from the array's prototype, so it assumed a result type and side-effect-free behavior that did not hold at runtime.
**Steps:**
1. Store elements of type T1 in an array and type T2 in its prototype; JIT assumes pop() returns T1 but runtime returns T2, causing type confusion.
2. Alternatively install indexed accessors on the prototype; JIT assumes pop() is side-effect free, but the accessor executes.
3. Chain type confusion to out-of-bounds array access, then to arbitrary read/write.
**How found:** Independently found via fuzzing with Fuzzilli (type-confusion variant) and by Coinbase Security; also a known variant of incorrect side-effect modelling bugs in JIT compilers, plausibly found by manual code audit.
**Exploitation:** In-the-wild exploit used indexed accessors on the prototype to violate the JIT's side-effect-free assumption, escalating compiler bug to runtime OOB array access, type confusion, and arbitrary read/write; chained with CVE-2019-11708 sandbox escape per Coinbase.
**Escalation:** Chained with CVE-2019-11708 Firefox sandbox escape; dropped macOS malware detected by XProtect signature.
**Insight:** Audit JIT speculation guards for operations assumed side-effect-free: if a prototype can supply indexed accessors or differently-typed elements, the guard is incomplete. Fuzz with engines like Fuzzilli targeting prototype/array interactions.