
An exploit for CVE-2019-17026. It pops xcalc and was tested on Ubuntu (x64).
This is an exploit for CVE-2190-17026: IonMonkey type confusion with StoreElementHole and FallibleStoreElement
This exploit does not use a sandbox escape, so for testing the security.sandbox.content.level attribute in about:config needs to be set to 0. It should be possible to chain this with CVE-2020-0674 via PAC to get a sandbox escape on Windows.
The writeup for this vulnerability and the steps taken to exploit it can be found here.