CVE-2018-5108

MEDIUM

Firefox < 58 - Exposure of Sensitive Information via Blob URL Origin Attribute Violation

Title source: llm

Description

A Blob URL can violate origin attribute segregation, allowing it to be accessed from a private browsing tab and for data to be passed between the private browsing tab and a normal tab. This could allow for the leaking of private information specific to the private browsing context. This issue is mitigated by the requirement that the user enter the Blob URL manually in order for the access violation to occur. This vulnerability affects Firefox < 58.

References (5)

Core 5

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1040270

Third Party Advisory vendor-advisory x_refsource_ubuntu

https://usn.ubuntu.com/3544-1/

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/102786

Vendor Advisory x_refsource_confirm

https://www.mozilla.org/security/advisories/mfsa2018-02/

Issue Tracking, Permissions Required x_refsource_confirm

https://bugzilla.mozilla.org/show_bug.cgi?id=1421099

Scores

CVSS v3 4.3

EPSS 0.0030

EPSS Percentile 53.8%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Details

CWE

CWE-200

Status published

Products (4)

canonical/ubuntu_linux 14.04

canonical/ubuntu_linux 16.04

canonical/ubuntu_linux 17.10

mozilla/firefox < 57.0.4

Published Jun 11, 2018

Tracked Since Feb 18, 2026