CVE-2018-5131

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

Under certain circumstances the "fetch()" API can return transient local copies of resources that were sent with a "no-store" or "no-cache" cache header instead of downloading a copy from the network as it should. This can result in previously stored, locally cached data of a website being accessible to users if they share a common profile while browsing. This vulnerability affects Firefox ESR < 52.7 and Firefox < 59.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Jun 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-51326.5The Find API for WebExtensions can search some privileged pages, such as "about:debugging", if these pages are open in a tab. This could all CVE-2018-51336.5If the "app.support.baseURL" preference is changed by a malicious local program to contain HTML and script content, this content is not sani CVE-2018-51347.5WebExtensions may use "view-source:" URLs to view local "file:" URL content, as well as content stored in "about:cache", bypassing restricti CVE-2018-51357.5WebExtensions can bypass normal restrictions in some circumstances and use "browser.tabs.executeScript" to inject scripts into contexts wher CVE-2018-51367.5A shared worker created from a "data:" URL in one tab can be shared by another tab with a different origin, bypassing the same-origin policy CVE-2018-51377.5A legacy extension's non-contentaccessible, defined resources can be loaded by an arbitrary web page through script. This script does this b CVE-2018-51385.3A spoofing vulnerability can occur when a malicious site with an extremely long domain name is opened in an Android Custom Tab (a browser pa CVE-2018-51405.3Image for moz-icons can be accessed through the "moz-icon:" protocol through script in web content even when otherwise prohibited. This coul CVE-2018-51418.2A vulnerability in the notifications Push API where notifications can be sent through service workers by web content without direct user int CVE-2018-51425.3If Media Capture and Streams API permission is requested from documents with "data:" or "blob:" URLs, the permission notifications do not pr CVE-2018-51436.1URLs using "javascript:" have the protocol removed when pasted into the addressbar to protect users from cross-site scripting (XSS) attacks,CVE-2018-51447.3An integer overflow can occur during conversion of text to some Unicode character sets due to an unchecked length parameter. This vulnerabil