CVE-2018-12382

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The displayed addressbar URL can be spoofed on Firefox for Android using a javascript: URI in concert with JavaScript to insert text before the loaded domain name, scrolling the loaded domain out of view to the right. This can lead to user confusion. *This vulnerability only affects Firefox for Android < 62.*

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 62

References

http://www.securityfocus.com/bid/105276Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041610Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1479311Exploit, Issue Tracking, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2018-20/Vendor Advisory
http://www.securityfocus.com/bid/105276Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041610Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1479311Exploit, Issue Tracking, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2018-20/Vendor Advisory

Timeline

Published: Oct 18, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-123835.5If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessible CVE-2018-123845.9When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. Th CVE-2018-123857.0A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profile CVE-2018-123868.1A vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and write. This leads to rem CVE-2018-123879.1A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in the stack pointer bei CVE-2018-123888.8Mozilla developers and community members reported memory safety bugs present in Firefox 62. Some of these bugs showed evidence of memory cor CVE-2018-123898.8Mozilla developers and community members reported memory safety bugs present in Firefox ESR 60.2. Some of these bugs showed evidence of memo CVE-2018-12397.2Dell EMC Unity Operating Environment (OE) versions prior to 4.3.0.1522077968 are affected by multiple OS command injection vulnerabilities. CVE-2018-123909.8Mozilla developers and community members reported memory safety bugs present in Firefox 62 and Firefox ESR 60.2. Some of these bugs showed e CVE-2018-123918.8During HTTP Live Stream playback on Firefox for Android, audio data can be accessed across origins in violation of security policies. Becaus CVE-2018-123929.8When manipulating user events in nested loops while opening a document through script, it is possible to trigger a potentially exploitable c CVE-2018-123937.5A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of scripts to an internal UTF-16 repres