CVE-2018-12396: Medium severity Mozilla Firefox vulnerability
A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other events. This allows for potential privilege escalation by the WebExtension on sites where content scripts should not be run.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2018-12396?
CVE-2018-12396 is a vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other events, potentially allowing for privilege escalation.
Which software versions are affected by CVE-2018-12396?
Firefox ESR < 60.3 and Firefox < 63.0 are affected by CVE-2018-12396.
What is the severity of CVE-2018-12396?
CVE-2018-12396 has a severity rating of 6.5, which is considered medium.
How can I fix CVE-2018-12396?
To fix CVE-2018-12396, update Firefox ESR to version 60.3 or later, or update Firefox to version 63.0 or later.
Where can I find more information about CVE-2018-12396?
You can find more information about CVE-2018-12396 on the following references: [Mozilla Bugzilla](https://bugzilla.mozilla.org/show_bug.cgi?id=1483602), [Mozilla Security Advisory](https://www.mozilla.org/en-US/security/advisories/mfsa2018-27/), [CVE Mitre](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12396).