CVE-2018-12402: Medium severity Mozilla Firefox vulnerability
Last updated 25 August 2025
Other sources
The internal WebBrowserPersist code does not use correct origin context for a resource being saved. This manifests when sub-resources are loaded as part of "Save Page As..." functionality. For example, a malicious page could recover a visitor's Windows username and NTLM hash by including resources otherwise unreachable to the malicious page, if they can convince the visitor to save the complete web page. Similarly, SameSite cookies are sent on cross-origin requests when the "Save Page As..." menu item is selected to save a page, which can result in saving the wrong version of resources based on those cookies.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2018-12402?
CVE-2018-12402 is a vulnerability in Mozilla Firefox where the internal WebBrowserPersist code does not use the correct origin context for a resource being saved.
How does CVE-2018-12402 manifest?
CVE-2018-12402 manifests when sub-resources are loaded as part of the "Save Page As..." functionality.
What can a malicious page do with CVE-2018-12402?
A malicious page could recover a visitor's Windows username and NTLM hash by including resources.
What is the severity of CVE-2018-12402?
CVE-2018-12402 has a severity rating of medium (6.5).
How can I fix CVE-2018-12402?
To fix CVE-2018-12402, update to Mozilla Firefox version 63.0 or higher.
Where can I find more information about CVE-2018-12402?
You can find more information about CVE-2018-12402 on the Mozilla Security Advisories website.