Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2018-5134: Firefox allows extensions to view local files
CVE-2018-5134 · published 8 years ago
Summary
Extensions built for Firefox can use a special web address (view‑source:) to read files stored on a computer or data cached by the browser, even though they should only see limited content. This could let a malicious add‑on steal private information or expose internal data. Updating Firefox to version 59 or later removes this capability.
What to do
- Update mozilla firefox to version 59.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| mozilla | firefox |
< 59.0 cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* |
Original advisory text
WebExtensions may use "view-source:" URLs to view local "file:" URL content, as well as content stored in "about:cache", bypassing restrictions that only allow WebExtensions to view specific conten...
WebExtensions may use "view-source:" URLs to view local "file:" URL content, as well as content stored in "about:cache", bypassing restrictions that only allow WebExtensions to view specific content. This vulnerability affects Firefox < 59.
References
- http://www.securityfocus.com/bid/103386 Third Party Advisory VDB Entry
- https://usn.ubuntu.com/3596-1/ Third Party Advisory
- http://www.securitytracker.com/id/1040514 Third Party Advisory VDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=1429379 Permissions Required
- https://www.mozilla.org/security/advisories/mfsa2018-06/ Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-200Information Exposure
Timeline
Published11 Jun 2018
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-5134 · NVD
Track software like this
Free during beta