PT-2017-3675 · Mozilla+2 · Firefox+2

Ronen Zilberman

·

Published

2017-09-03

·

Updated

2024-12-12

·

CVE-2018-5116

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions prior to 58
Description: The issue is related to an insufficiency in the source confirmation mechanism of the WebExtensions extension in Mozilla Firefox. This can allow a remote attacker to gain unauthorized access to protected information, compromise its integrity, and cause a denial of service. The vulnerability can be exploited by malicious extensions that have the "ActiveTab" permission, allowing them to access frames hosted within the active tab, even if they are cross-origin, and inject frames from arbitrary origins into the loaded page, thus bypassing same-origin user expectations.
Recommendations: For versions prior to 58, update to version 58 or later to resolve the issue. As a temporary workaround, consider disabling the use of extensions with the "ActiveTab" permission until a patch is available. Restrict access to the ActiveTab permission to minimize the risk of exploitation. Avoid using extensions that can inject frames from arbitrary origins into the loaded page until the issue is resolved.

Fix

Origin Validation Error

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

ALT-PU-2018-1178
ALT-PU-2018-1854
BDU:2018-00866
CVE-2018-5116
OPENSUSE-SU-2024:10600-1
OPENSUSE-SU-2024:14572-1
USN-3544-1
USN-3544-2

Affected Products

Alt Linux
Firefox
Ubuntu