PT-2017-3675 · Mozilla+2 · Firefox+2
Ronen Zilberman
·
Published
2017-09-03
·
Updated
2024-12-12
·
CVE-2018-5116
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Mozilla Firefox versions prior to 58
Description:
The issue is related to an insufficiency in the source confirmation mechanism of the WebExtensions extension in Mozilla Firefox. This can allow a remote attacker to gain unauthorized access to protected information, compromise its integrity, and cause a denial of service. The vulnerability can be exploited by malicious extensions that have the "ActiveTab" permission, allowing them to access frames hosted within the active tab, even if they are cross-origin, and inject frames from arbitrary origins into the loaded page, thus bypassing same-origin user expectations.
Recommendations:
For versions prior to 58, update to version 58 or later to resolve the issue. As a temporary workaround, consider disabling the use of extensions with the "ActiveTab" permission until a patch is available. Restrict access to the
ActiveTab permission to minimize the risk of exploitation. Avoid using extensions that can inject frames from arbitrary origins into the loaded page until the issue is resolved.Fix
Origin Validation Error
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Firefox
Ubuntu