CVE-2018-18497

Severity: medium (CVSS 6.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-02-28 · updated 2026-06-17

Description

Limitations on the URIs allowed to WebExtensions by the browser.windows.create API can be bypassed when a pipe in the URL field is used within the extension to load multiple pages as a single argument. This could allow a malicious WebExtension to open privileged about: or file: locations. This vulnerability affects Firefox < 64.

Affected products

Canonical Ubuntu Linux: 14.04, 16.04, 18.04, 18.10
Mozilla Firefox: before 64.0 — fixed in 64.0

How to fix

Upgrade to a fixed version: Mozilla Firefox 64.0. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/106167
https://bugzilla.mozilla.org/show_bug.cgi?id=1488180
https://usn.ubuntu.com/3844-1/
https://www.mozilla.org/security/advisories/mfsa2018-29/
http://www.securityfocus.com/bid/106167
https://bugzilla.mozilla.org/show_bug.cgi?id=1488180
https://usn.ubuntu.com/3844-1/
https://www.mozilla.org/security/advisories/mfsa2018-29/

Get alerted when CVE-2018-18497 or the next vulnerability affects your stack