CVE-2018-12396
Moderate
CVE-2018-12396
A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other events. This allows for potential privilege escalation by the WebExtension on sites where content scripts should not be run. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.
Exploit probability
2.3%
Published
February 28, 2019
Required by
Not available
Last source change
April 16, 2026
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
Open Source Vulnerabilities
CVE-2018-12396
View original source
A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other events. This allows for potential privilege escalation by the WebExtension on sites where content scripts should not be run. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.
05 / REFERENCES
Further evidence
- http://www.securityfocus.com/bid/105718
- http://www.securitytracker.com/id/1041944
- https://access.redhat.com/errata/RHSA-2018:3005
- https://access.redhat.com/errata/RHSA-2018:3006
- https://bugzilla.mozilla.org/show_bug.cgi?id=1483602
- https://lists.debian.org/debian-lts-announce/2018/11/msg00008.html
- https://security.gentoo.org/glsa/201811-04
- https://usn.ubuntu.com/3801-1/
- https://www.debian.org/security/2018/dsa-4324
- https://www.mozilla.org/security/advisories/mfsa2018-26/
- https://www.mozilla.org/security/advisories/mfsa2018-27/