CVE-2018-5138

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A spoofing vulnerability can occur when a malicious site with an extremely long domain name is opened in an Android Custom Tab (a browser panel inside another app) and the default browser is Firefox for Android. This could allow an attacker to spoof which page is actually loaded and in use. Note: this issue only affects Firefox for Android. Other versions and operating systems are unaffected. This vulnerability affects Firefox < 59.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Jun 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-51405.3Image for moz-icons can be accessed through the "moz-icon:" protocol through script in web content even when otherwise prohibited. This coul CVE-2018-51418.2A vulnerability in the notifications Push API where notifications can be sent through service workers by web content without direct user int CVE-2018-51425.3If Media Capture and Streams API permission is requested from documents with "data:" or "blob:" URLs, the permission notifications do not pr CVE-2018-51436.1URLs using "javascript:" have the protocol removed when pasted into the addressbar to protect users from cross-site scripting (XSS) attacks,CVE-2018-51447.3An integer overflow can occur during conversion of text to some Unicode character sets due to an unchecked length parameter. This vulnerabil CVE-2018-51459.8Memory safety bugs were reported in Firefox ESR 52.6. These bugs showed evidence of memory corruption and we presume that with enough effort CVE-2018-51468.8An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest. This vulnerability affects Firefo CVE-2018-51479.8The libtremor library has the same flaw as CVE-2018-5146. This library is used by Firefox in place of libvorbis on Android and ARM platforms CVE-2018-51489.8A use-after-free vulnerability can occur in the compositor during certain graphics operations when a raw pointer is used instead of a refere CVE-2018-51509.8Memory safety bugs were reported in Firefox 59, Firefox ESR 52.7, and Thunderbird 52.7. Some of these bugs showed evidence of memory corrupt CVE-2018-51519.8Memory safety bugs were reported in Firefox 59. Some of these bugs showed evidence of memory corruption and we presume that with enough effo CVE-2018-51526.5WebExtensions with the appropriate permissions can attach content scripts to Mozilla sites such as accounts.firefox.com and listen to networ