Mozilla · Firefox · CVE-2018-5152
**Name of the Vulnerable Software and Affected Versions**
Firefox versions prior to 60
**Description**
The issue is related to WebExtensions with appropriate permissions that can attach content scripts to Mozilla sites, such as accounts.firefox.com, and listen to network traffic through the "webRequest" API. This allows for the interception of `username` and an encrypted `password` during login to Firefox Accounts. The issue is limited to the process of user login to the website and the data displayed to the user once logged in. It does not expose synchronization traffic directly.
**Recommendations**
For versions prior to 60, update to version 60 or later to resolve the issue. As a temporary workaround, consider restricting the use of WebExtensions with the "webRequest" API permission to minimize the risk of exploitation. Avoid using WebExtensions that require sensitive information, such as `username` and `password`, until the issue is resolved.