CVE-2018-5152

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

WebExtensions with the appropriate permissions can attach content scripts to Mozilla sites such as accounts.firefox.com and listen to network traffic to the site through the "webRequest" API. For example, this allows for the interception of username and an encrypted password during login to Firefox Accounts. This issue does not expose synchronization traffic directly and is limited to the process of user login to the website and the data displayed to the user once logged in. This vulnerability affects Firefox < 60.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-327

Affected software

No affected versions have been published.

Timeline

Published: Jun 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-51537.5If websocket data is sent with mixed text and binary in a single message, the binary data can be corrupted. This can result in an out-of-bou CVE-2018-51549.8A use-after-free vulnerability can occur while enumerating attributes during SVG animations with clip paths. This results in a potentially e CVE-2018-51559.8A use-after-free vulnerability can occur while adjusting layout during SVG animations with text paths. This results in a potentially exploit CVE-2018-51569.8A vulnerability can occur when capturing a media stream when the media source type is changed as the capture is occurring. This can result i CVE-2018-51577.5Same-origin protections for the PDF viewer can be bypassed, allowing a malicious site to intercept messages meant for the viewer. This could CVE-2018-51588.8The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through a crafte CVE-2018-51599.8An integer overflow can occur in the Skia library due to 32-bit integer use in an array without integer overflow checks, resulting in possib CVE-2018-51607.5WebRTC can use a "WrappedI420Buffer" pixel buffer but the owning image object can be freed while it is still in use. This can result in the CVE-2018-51614.3Crafted message headers can cause a Thunderbird process to hang on receiving the message. This vulnerability affects Thunderbird ESR < 52.8 CVE-2018-51627.5Plaintext of decrypted emails can leak through the src attribute of remote images, or links. This vulnerability affects Thunderbird ESR < 52 CVE-2018-51638.1If a malicious attacker has used another vulnerability to gain full control over a content process, they may be able to replace the alternat CVE-2018-51646.1Content Security Policy (CSP) is not applied correctly to all parts of multipart content sent with the "multipart/x-mixed-replace" MIME type