CVE-2018-18495

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

WebExtension content scripts can be loaded into about: pages in some circumstances, in violation of the permissions granted to extensions. This could allow an extension to interfere with the loading and usage of these pages and use capabilities that were intended to be restricted from extensions. This vulnerability affects Firefox < 64.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 64

References

http://www.securityfocus.com/bid/106167Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1427585Issue Tracking, Permissions Required, Vendor Advisory
https://usn.ubuntu.com/3844-1/Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2018-29/Vendor Advisory
http://www.securityfocus.com/bid/106167Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1427585Issue Tracking, Permissions Required, Vendor Advisory
https://usn.ubuntu.com/3844-1/Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2018-29/Vendor Advisory

Timeline

Published: Feb 28, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-184968.8When the RSS Feed preview about:feeds page is framed within another page, it can be used in concert with scripted content for a clickjacking CVE-2018-184976.5Limitations on the URIs allowed to WebExtensions by the browser.windows.create API can be bypassed when a pipe in the URL field is used with CVE-2018-184989.8A potential vulnerability leading to an integer overflow can occur during buffer size calculations for images when a raw value is used inste CVE-2018-184996.5A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv="refresh" on a page to cause a re CVE-2018-18507.5IBM Security Access Manager Appliance 9.0.3.1, 9.0.4.0 and 9.0.5.0 could allow unauthorized administration operations when Advanced Access C CVE-2018-185009.8A use-after-free vulnerability can occur while parsing an HTML5 stream in concert with custom HTML elements. This results in the stream pars CVE-2018-185019.8Mozilla developers and community members reported memory safety bugs present in Firefox 64 and Firefox ESR 60.4. Some of these bugs showed e CVE-2018-185029.8Mozilla developers and community members reported memory safety bugs present in Firefox 64. Some of these bugs showed evidence of memory cor CVE-2018-185038.8When JavaScript is used to create and manipulate an audio buffer, a potentially exploitable crash may occur because of a compartment mismatc CVE-2018-185049.8A crash and out-of-bounds read can occur when the buffer of a texture client is freed while it is still in use during graphic operations. Th CVE-2018-1850510.0An earlier fix for an Inter-process Communication (IPC) vulnerability, CVE-2011-3079, added authentication to communication between IPC endp CVE-2018-185065.9When proxy auto-detection is enabled, if a web server serves a Proxy Auto-Configuration (PAC) file or if a PAC file is loaded locally, this