Published: 28/02/2019 Updated: 24/08/2020

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 6.5 | Impact Score: 3.6 | Exploitability Score: 2.8

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

WebExtension content scripts can be loaded into about: pages in some circumstances, in violation of the permissions granted to extensions. This could allow an extension to interfere with the loading and usage of these pages and use capabilities that were intended to be restricted from extensions. This vulnerability affects Firefox < 64.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mozilla firefox
canonical ubuntu linux 14.04
canonical ubuntu linux 16.04
canonical ubuntu linux 18.04
canonical ubuntu linux 18.10

Firefox could be made to crash or run programs as your login if it opened a malicious website ...

Mozilla Foundation Security Advisory 2018-29 Security vulnerabilities fixed in Firefox 64 Announced December 11, 2018 Impact critical Products Firefox Fixed in Firefox 64 ...

A security issue has been found in Firefox < 640, where WebExtension content scripts can be loaded into about: pages in some circumstances, in violation of the permissions granted to extensions This could allow an extension to interfere with the loading and usage of these pages and use capabilities that were intended to be restricted from exte ...

CWE chaining concept and tools

cwe-toolkit Purpose There are many cases where an individual security flaw may have an insignificant impact However, when conditions allow several of these flaws to be used together, the impact of these weaknesses can multiply together and become a significant security vulnerability The current state of CWEs across the industry only allows tracking of a single root cause, whi

CWE-732 https://www.mozilla.org/security/advisories/mfsa2018-29/https://bugzilla.mozilla.org/show_bug.cgi?id=1427585 https://usn.ubuntu.com/3844-1/http://www.securityfocus.com/bid/106167 https://usn.ubuntu.com/3844-1/https://nvd.nist.gov

CVE-2018-18495

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect