CVE-2018-5138: Input Validation
First published: Tue Mar 13 2018(Updated: )
A spoofing vulnerability can occur when a malicious site with an extremely long domain name is opened in an Android Custom Tab (a browser panel inside another app) and the default browser is Firefox for Android. This could allow an attacker to spoof which page is actually loaded and in use. Note: this issue only affects Firefox for Android. Other versions and operating systems are unaffected.
Credit: security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla Firefox | <59 | 59 |
| <59 | 59 | |
| Mozilla Firefox | <59.0 | |
| Google Android |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Peer vulnerabilities
(Found alongside the following vulnerabilities)
Frequently Asked Questions
What is CVE-2018-5138?
CVE-2018-5138 is a spoofing vulnerability that can occur when a malicious site with an extremely long domain name is opened in an Android Custom Tab with Firefox for Android as the default browser.
How does CVE-2018-5138 affect Firefox for Android?
CVE-2018-5138 allows an attacker to spoof which page is actually loaded and in use in Firefox for Android.
What is the severity of CVE-2018-5138?
CVE-2018-5138 has a severity score of 5.3, which is considered medium.
How can I fix CVE-2018-5138 in Firefox for Android?
Update Firefox for Android to version 59 or later to fix CVE-2018-5138.
Are all versions of Android vulnerable to CVE-2018-5138?
No, Google Android is not vulnerable to CVE-2018-5138.
- agent/type
- agent/first-publish-date
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/severity
- agent/author
- agent/weakness
- agent/references
- agent/description
- collector/mozilla-advisory
- source/Mozilla
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/event
- agent/trending
- vendor/mozilla
- canonical/mozilla firefox
- vendor/google
- canonical/google android