CVE-2018-18495

—

CVSS 3.0

6.5 medium

EPSS

2%p75

Published

Feb 28, 2019 (Feb 28, 2019)

Modified

Jun 17, 2026

Description

WebExtension content scripts can be loaded into about: pages in some circumstances, in violation of the permissions granted to extensions. This could allow an extension to interfere with the loading and usage of these pages and use capabilities that were intended to be restricted from extensions. This vulnerability affects Firefox < 64.

Vendors: mozilla canonical
Products: firefox, ubuntu linux
Weakness: CWE-732
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (1.7%)

In the news0 stories

No ingested article mentions this CVE yet.