Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-18497: Firefox extensions can open restricted pages

CVE-2018-18497 · published 7 years ago

Summary

Extensions in Firefox versions before 64 can trick the browser into opening internal pages such as about: or file: URLs by using a pipe character in the URL field. This could let a malicious add‑on view or manipulate sensitive information. Upgrade Firefox to version 64 or newer to stop the issue.

What to do

Update mozilla firefox to version 64.0 or later.

Affected software

Vendor	Product	Affected versions
mozilla	firefox	< 64.0 `cpe:2.3:a:mozilla:firefox::::::::`
canonical	ubuntu_linux	14.04 16.04 18.04 18.10 `cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::`

Original advisory text

Limitations on the URIs allowed to WebExtensions by the browser.windows.create API can be bypassed when a pipe in the URL field is used within the extension to load multiple pages as a single argument. This could allow a malicious WebExtension to open privileged about: or file: locations. This vulnerability affects Firefox < 64.

References

http://www.securityfocus.com/bid/106167 Third Party Advisory VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1488180 Issue Tracking Permissions Required Vendor Advisory
https://usn.ubuntu.com/3844-1/ Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2018-29/ Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.5 Medium

Exploitation

2% chance of attack within 30 days

Timeline

Published28 Feb 2019

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2018-18497 · NVD

Track software like this

Free during beta