CVE-2018-5142

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

If Media Capture and Streams API permission is requested from documents with "data:" or "blob:" URLs, the permission notifications do not properly display the originating domain. The notification states "Unknown protocol" as the requestee, leading to user confusion about which site is asking for this permission. This vulnerability affects Firefox < 59.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published: Jun 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-51436.1URLs using "javascript:" have the protocol removed when pasted into the addressbar to protect users from cross-site scripting (XSS) attacks,CVE-2018-51447.3An integer overflow can occur during conversion of text to some Unicode character sets due to an unchecked length parameter. This vulnerabil CVE-2018-51459.8Memory safety bugs were reported in Firefox ESR 52.6. These bugs showed evidence of memory corruption and we presume that with enough effort CVE-2018-51468.8An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest. This vulnerability affects Firefo CVE-2018-51479.8The libtremor library has the same flaw as CVE-2018-5146. This library is used by Firefox in place of libvorbis on Android and ARM platforms CVE-2018-51489.8A use-after-free vulnerability can occur in the compositor during certain graphics operations when a raw pointer is used instead of a refere CVE-2018-51509.8Memory safety bugs were reported in Firefox 59, Firefox ESR 52.7, and Thunderbird 52.7. Some of these bugs showed evidence of memory corrupt CVE-2018-51519.8Memory safety bugs were reported in Firefox 59. Some of these bugs showed evidence of memory corruption and we presume that with enough effo CVE-2018-51526.5WebExtensions with the appropriate permissions can attach content scripts to Mozilla sites such as accounts.firefox.com and listen to networ CVE-2018-51537.5If websocket data is sent with mixed text and binary in a single message, the binary data can be corrupted. This can result in an out-of-bou CVE-2018-51549.8A use-after-free vulnerability can occur while enumerating attributes during SVG animations with clip paths. This results in a potentially e CVE-2018-51559.8A use-after-free vulnerability can occur while adjusting layout during SVG animations with text paths. This results in a potentially exploit