CVE-2018-5116

3Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackepss 1.2%

probabilidad de explotación

1.2%top 34% de las CVE

explotación observada

noninguna fuente lo reporta

WebExtensions with the "ActiveTab" permission are able to access frames hosted within the active tab even if the frames are cross-origin. Malicious extensions can inject frames from arbitrary origins into the loaded page and then interact with them, bypassing same-origin user expectations with this permission. This vulnerability affects Firefox < 58.

Productos afectados

Mozilla · Firefox

Referencias

https://bugzilla.mozilla.org/show_bug.cgi?id=1396399 https://usn.ubuntu.com/3544-1/https://www.mozilla.org/security/advisories/mfsa2018-02/http://www.securityfocus.com/bid/102786 http://www.securitytracker.com/id/1040270