CVE-2018-5138

Severity: medium (CVSS 5.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-06-11 · updated 2026-06-17
Weakness: CWE-20

Description

A spoofing vulnerability can occur when a malicious site with an extremely long domain name is opened in an Android Custom Tab (a browser panel inside another app) and the default browser is Firefox for Android. This could allow an attacker to spoof which page is actually loaded and in use. Note: this issue only affects Firefox for Android. Other versions and operating systems are unaffected. This vulnerability affects Firefox < 59.

Affected products

Mozilla Firefox: before 59.0 — fixed in 59.0

How to fix

Upgrade to a fixed version: Mozilla Firefox 59.0. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/103386
http://www.securitytracker.com/id/1040514
https://bugzilla.mozilla.org/show_bug.cgi?id=1432624
https://www.mozilla.org/security/advisories/mfsa2018-06/
http://www.securityfocus.com/bid/103386
http://www.securitytracker.com/id/1040514
https://bugzilla.mozilla.org/show_bug.cgi?id=1432624
https://www.mozilla.org/security/advisories/mfsa2018-06/

Get alerted when CVE-2018-5138 or the next vulnerability affects your stack