- Original bug caught in the wild by Qihoo 360.
- Exploit written by maxpl0it.
- Works on Firefox < 72.0.1
This is an exploit for CVE-2190-17026: IonMonkey type confusion with StoreElementHole and FallibleStoreElement
This exploit does not use a sandbox escape, so for testing the security.sandbox.content.level attribute in about:config needs to be set to 0. It should be possible to chain this with CVE-2020-0674 via PAC to get a sandbox escape on Windows.
The writeup for this vulnerability and the steps taken to exploit it can be found here.