CVE-2018-5143: XSS
Last updated 25 August 2025
Other sources
URLs using "javascript:" have the protocol removed when pasted into the addressbar to protect users from cross-site scripting (XSS) attacks, but if a tab character is embedded in the "javascript:" URL the protocol is not removed and the script will execute. This could allow users to be socially engineered to run an XSS attack against themselves. This vulnerability affects Firefox < 59.
— Launchpad
URLs using javascript: have the protocol removed when pasted into the addressbar to protect users from cross-site scripting (XSS) attacks, but if a tab character is embedded in the javascript: URL the protocol is not removed and the script will execute. This could allow users to be socially engineered to run an XSS attack against themselves.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2018-5143?
CVE-2018-5143 is a vulnerability in Mozilla Firefox where the protocol is not removed from a 'javascript:' URL if it contains a tab character, allowing the execution of scripts.
What is the severity of CVE-2018-5143?
The severity of CVE-2018-5143 is medium with a CVSS score of 6.1.
Which software is affected by CVE-2018-5143?
Mozilla Firefox versions up to and exclusive of 59.0, Canonical Ubuntu Linux 14.04, 16.04, and 17.10.
How can I fix CVE-2018-5143 in Mozilla Firefox?
Update Mozilla Firefox to version 59.0 or higher.
Where can I find more information about CVE-2018-5143?
You can find more information about CVE-2018-5143 at the following links: [Bugzilla](https://bugzilla.mozilla.org/show_bug.cgi?id=1422643), [Mozilla Security Advisory](https://www.mozilla.org/en-US/security/advisories/mfsa2018-06/), [SecurityFocus](http://www.securityfocus.com/bid/103386).