CVE-2018-25058: medium-severity vulnerability in Twitter-Post-Fetcher
Twitter-Post-Fetcher Link Target twitterFetcher.js reverse tabnabbing
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Twitter-Post-Fetcher opens links without protection against reverse tabnabbing, allowing malicious pages to access and control the original browser tab. This can be used to redirect users to phishing sites or steal session information.
The vulnerability exists in twitterFetcher.js Link Target Handler where links are opened without rel="noopener noreferrer" protection, enabling reverse tabnabbing attacks. An attacker can craft malicious tweets containing links that, when clicked, gain window.opener access to manipulate the original page. Affects Twitter-Post-Fetcher versions up to 17.x; fixed in 18.0.0.