CVE-2018-5135

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

WebExtensions can bypass normal restrictions in some circumstances and use "browser.tabs.executeScript" to inject scripts into contexts where this should not be allowed, such as pages from other WebExtensions or unprivileged "about:" pages. This vulnerability affects Firefox < 59.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Jun 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-51367.5A shared worker created from a "data:" URL in one tab can be shared by another tab with a different origin, bypassing the same-origin policy CVE-2018-51377.5A legacy extension's non-contentaccessible, defined resources can be loaded by an arbitrary web page through script. This script does this b CVE-2018-51385.3A spoofing vulnerability can occur when a malicious site with an extremely long domain name is opened in an Android Custom Tab (a browser pa CVE-2018-51405.3Image for moz-icons can be accessed through the "moz-icon:" protocol through script in web content even when otherwise prohibited. This coul CVE-2018-51418.2A vulnerability in the notifications Push API where notifications can be sent through service workers by web content without direct user int CVE-2018-51425.3If Media Capture and Streams API permission is requested from documents with "data:" or "blob:" URLs, the permission notifications do not pr CVE-2018-51436.1URLs using "javascript:" have the protocol removed when pasted into the addressbar to protect users from cross-site scripting (XSS) attacks,CVE-2018-51447.3An integer overflow can occur during conversion of text to some Unicode character sets due to an unchecked length parameter. This vulnerabil CVE-2018-51459.8Memory safety bugs were reported in Firefox ESR 52.6. These bugs showed evidence of memory corruption and we presume that with enough effort CVE-2018-51468.8An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest. This vulnerability affects Firefo CVE-2018-51479.8The libtremor library has the same flaw as CVE-2018-5146. This library is used by Firefox in place of libvorbis on Android and ARM platforms CVE-2018-51489.8A use-after-free vulnerability can occur in the compositor during certain graphics operations when a raw pointer is used instead of a refere