CVE-2018-12397

A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed…

published February 28, 2019

CVSS
—
EPSS
0%
Percentile
29.7
In the wild
Unconfirmed
What it is

A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed to the user. This allows extensions to run content scripts in local pages without permission warnings when a local file is opened. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00371 · 29.7th percentile
Published
2019-02-28T18:00Z
EPSS history
Timeline
  • 28 FEB 18:00Z
    A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed…
    cvelistv5