Description
A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other events. This allows for potential privilege escalation by the WebExtension on sites where content scripts should not be run. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.
References (11)
Core 11
Core References
Broken Link, Issue Tracking, Vendor Advisory x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=1483602
Third Party Advisory vendor-advisory
x_refsource_debian
https://www.debian.org/security/2018/dsa-4324
Vendor Advisory x_refsource_confirm
https://www.mozilla.org/security/advisories/mfsa2018-26/
Third Party Advisory vendor-advisory
x_refsource_gentoo
https://security.gentoo.org/glsa/201811-04
Vendor Advisory x_refsource_confirm
https://www.mozilla.org/security/advisories/mfsa2018-27/
Third Party Advisory vendor-advisory
x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:3005
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/105718
Third Party Advisory vendor-advisory
x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:3006
Third Party Advisory vendor-advisory
x_refsource_ubuntu
https://usn.ubuntu.com/3801-1/
Third Party Advisory mailing-list
x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2018/11/msg00008.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1041944
Scores
CVSS v3
6.5
EPSS
0.0114
EPSS Percentile
78.5%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Details
CWE
CWE-732
Status
published
Products (17)
canonical/ubuntu_linux
14.04
canonical/ubuntu_linux
16.04
canonical/ubuntu_linux
18.04
canonical/ubuntu_linux
18.10
debian/debian_linux
8.0
debian/debian_linux
9.0
mozilla/firefox
< 63.0
mozilla/firefox_esr
< 60.3
redhat/enterprise_linux_desktop
6.0
redhat/enterprise_linux_desktop
7.0
... and 7 more
Published
Feb 28, 2019
Tracked Since
Feb 18, 2026