CVE-2018-5168

Sites can bypass security checks on permissions to install lightweight themes by manipulating the "baseURI" property of the theme element

published June 11, 2018

CVSS
—
EPSS
2%
Percentile
83.4
In the wild
Unconfirmed
What it is

Sites can bypass security checks on permissions to install lightweight themes by manipulating the "baseURI" property of the theme element. This could allow a malicious site to install a theme without user interaction which could contain offensive or embarrassing images. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02332 · 83.4th percentile
Published
2018-06-11T21:00Z
EPSS history
Timeline
  • 11 JUN 21:00Z
    Sites can bypass security checks on permissions to install lightweight themes by manipulating the "baseURI" property of the theme element
    cvelistv5