CVE-2018-5138: Input Validation
A spoofing vulnerability can occur when a malicious site with an extremely long domain name is opened in an Android Custom Tab (a browser panel inside another app) and the default browser is Firefox for Android. This could allow an attacker to spoof which page is actually loaded and in use. Note: this issue only affects Firefox for Android. Other versions and operating systems are unaffected.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2018-5138?
CVE-2018-5138 is a spoofing vulnerability that can occur when a malicious site with an extremely long domain name is opened in an Android Custom Tab with Firefox for Android as the default browser.
How does CVE-2018-5138 affect Firefox for Android?
CVE-2018-5138 allows an attacker to spoof which page is actually loaded and in use in Firefox for Android.
What is the severity of CVE-2018-5138?
CVE-2018-5138 has a severity score of 5.3, which is considered medium.
How can I fix CVE-2018-5138 in Firefox for Android?
Update Firefox for Android to version 59 or later to fix CVE-2018-5138.
Are all versions of Android vulnerable to CVE-2018-5138?
No, Google Android is not vulnerable to CVE-2018-5138.