CVE-2018-5124

—

CVSS 3.0

6.1 medium

EPSS

1%p61

Published

Apr 26, 2019 (Apr 26, 2019)

Modified

Jun 17, 2026

Description

Unsanitized output in the browser UI leaves HTML tags in place and can result in arbitrary code execution in Firefox before version 58.0.1.

Vendors: mozilla
Products: firefox
Weakness: CWE-79
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (1.0%)

In the news4 stories

Week in review: The future of smartphone security, automated cyber threat anticipation

Help Net SecurityFeb 4, 00:00 UTC · Feb 4, 2018Ransomware in the wildCVE-2018-5124

60

Mozilla fixes a critical remote code execution vulnerability in Firefox

Security AffairsJan 31, 22:19 UTC · Jan 31, 2018Vulnerability CVE-2018-5124

60

Update Your Firefox Browser to Fix a Critical Remotely Exploitable Flaw

The Hacker NewsJan 31, 14:19 UTC · Jan 31, 2018Vulnerability CVE-2018-5124

60

Mozilla plugs critical and easily exploitable flaw in Firefox

Help Net SecurityJan 31, 00:00 UTC · Jan 31, 2018Vulnerability CVE-2018-5124

60