CVE-2018-18497

Limitations on the URIs allowed to WebExtensions by the browser.windows.create API can be bypassed when a pipe in the URL field is used within the extension to…

published February 28, 2019

CVSS
—
EPSS
2%
Percentile
76.3
In the wild
Unconfirmed
What it is

Limitations on the URIs allowed to WebExtensions by the browser.windows.create API can be bypassed when a pipe in the URL field is used within the extension to load multiple pages as a single argument. This could allow a malicious WebExtension to open privileged about: or file: locations. This vulnerability affects Firefox < 64.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01649 · 76.3th percentile
Published
2019-02-28T18:00Z
EPSS history
Timeline
  • 28 FEB 18:00Z
    Limitations on the URIs allowed to WebExtensions by the browser.windows.create API can be bypassed when a pipe in the URL field is used within the extension to…
    cvelistv5