# CVE-2019-17026: Firefox Type Confusion in IonMonkey

IonMonkey mis-modeled StoreElementHole side effects; a negative index triggers a property setter, letting JIT return stale values and cause type confusion.

- Payout: Real-world hack
- Severity: high
- Program: Mozilla Firefox
- Credited: Samuel Groß, Project Zero (Originally posted on [Project Zero blog](https://googleprojectzero.blogspot.com/p/rca.html) 2020-08-05)
- Disclosed: 2020-01-08
- CVE: CVE-2019-17026
- Write-up quality: 8/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2020/CVE-2019-17026.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2019-17026
- Tags: domain:browser impact:rce kind:incident platform:project-zero sev:high tech:firefox technique:incomplete-fix technique:source-review vuln:memory-corruption

**Target:** SpiderMonkey IonMonkey JIT compiler (StoreElementHole/FallibleStoreElement)
**Root cause:** StoreElementHole/FallibleStoreElement alias info failed to model that a negative index writes a property, invoking a setter with arbitrary JS side effects; the JIT then reuses stale values like OBJ.a.
**Steps:**
1. Build array of length 100, skip index 50 so it stays non-packed.
2. Define a setter on property '-1' via Object.defineProperty that sets OBJ.a = 1337.
3. Loop 2000 times calling f(obj, idx) where idx = 100 normally, -1 on last iteration.
4. In f: read v = OBJ.a, do obj[idx] = v, then return OBJ.a.
5. On last iteration StoreElementHole hits the '-1' setter, mutating OBJ.a, but JIT doesn't refetch and returns 42 instead of 1337.
**How found:** Patch generalized alias info for StoreElementHole/FallibleStoreElement to assume any side effect, implying prior modeling was wrong; reasoning that indexed accessors are guarded but negative indices fall through to property writes, yielding a setter invocation the JIT didn't expect.
**Exploitation:** Not available; no exploit sample. Likely weaponized like CVE-2019-11707 by turning the stale-value/type confusion into memory corruption for RCE in the browser.
**Escalation:** Chained with IE 0-day CVE-2020-0674 in Darkhotel/APT-C-06 campaigns, selecting the Firefox exploit when the target ran Firefox.
**Insight:** When a JIT store op is guarded against prototype accessors, test out-of-element-range keys (negative, non-integer) that route to ordinary property setters the guard doesn't cover; diff alias/side-effect metadata in patches to spot under-modeled ops.