CVE-2018-5135: High severity Mozilla Firefox vulnerability
Last updated 25 August 2025
Other sources
WebExtensions can bypass normal restrictions in some circumstances and use "browser.tabs.executeScript" to inject scripts into contexts where this should not be allowed, such as pages from other WebExtensions or unprivileged "about:" pages. This vulnerability affects Firefox < 59.
— Launchpad
WebExtensions can bypass normal restrictions in some circumstances and use browser.tabs.executeScript to inject scripts into contexts where this should not be allowed, such as pages from other WebExtensions or unprivileged about: pages.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2018-5135?
CVE-2018-5135 is a vulnerability that allows WebExtensions to bypass normal restrictions and inject scripts into contexts where it should not be allowed.
Which software is affected by CVE-2018-5135?
Firefox versions prior to 59 are affected by CVE-2018-5135.
What is the severity of CVE-2018-5135?
The severity of CVE-2018-5135 is high (CVSS score of 7.5).
How can I fix CVE-2018-5135?
To fix CVE-2018-5135, you should update Firefox to version 59 or later.
Where can I find more information about CVE-2018-5135?
You can find more information about CVE-2018-5135 on the Mozilla Bugzilla and Mozilla Security Advisories websites.