CVE-2018-5163

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

If a malicious attacker has used another vulnerability to gain full control over a content process, they may be able to replace the alternate data resources stored in the JavaScript Start-up Bytecode Cache (JSBC) for other JavaScript code. If the parent process then runs this replaced code, the executed script would be run with the parent process' privileges, escaping the sandbox on content processes. This vulnerability affects Firefox < 60.

Metrics

CVSS 3.0 8.1/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-281

Affected software

No affected versions have been published.

Timeline

Published: Jun 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-51646.1Content Security Policy (CSP) is not applied correctly to all parts of multipart content sent with the "multipart/x-mixed-replace" MIME type CVE-2018-51655.3In 32-bit versions of Firefox, the Adobe Flash plugin setting for "Enable Adobe Flash protected mode" is unchecked by default even though th CVE-2018-51667.5WebExtensions can use request redirection and a "filterReponseData" filter to bypass host permission settings to redirect network traffic an CVE-2018-51674.3The web console and JavaScript debugger do not sanitize all output that can be hyperlinked. Both will display "chrome:" links as active, cli CVE-2018-51685.3Sites can bypass security checks on permissions to install lightweight themes by manipulating the "baseURI" property of the theme element. T CVE-2018-51696.5If manipulated hyperlinked text with "chrome:" URL contained in it is dragged and dropped on the "home" icon, the home page can be reset to CVE-2018-51704.3It is possible to spoof the filename of an attachment and display an arbitrary attachment name. This could lead to a user opening a remote a CVE-2018-51724.3The Live Bookmarks page and the PDF viewer can run injected script content if a user pastes script from the clipboard into them while viewin CVE-2018-51735.3The filename appearing in the "Downloads" panel improperly renders some Unicode characters, allowing for the file name to be spoofed. This c CVE-2018-51747.5In the Windows 10 April 2018 Update, Windows Defender SmartScreen honors the "SEE_MASK_FLAG_NO_UI" flag associated with downloaded files and CVE-2018-51756.1A mechanism to bypass Content Security Policy (CSP) protections on sites that have a "script-src" policy of "'strict-dynamic'". If a target CVE-2018-51766.1The JSON Viewer displays clickable hyperlinks for strings that are parseable as URLs, including "javascript:" links. If a JSON file contains