What’s Vulnerable › Vulnerabilities

CVE-2018-5163

• Severity: high (CVSS 8.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-06-11 · updated 2026-06-17
• Weakness: CWE-281

Description

If a malicious attacker has used another vulnerability to gain full control over a content process, they may be able to replace the alternate data resources stored in the JavaScript Start-up Bytecode Cache (JSBC) for other JavaScript code. If the parent process then runs this replaced code, the executed script would be run with the parent process' privileges, escaping the sandbox on content processes. This vulnerability affects Firefox < 60.

Affected products

• Canonical Ubuntu Linux: 14.04, 16.04, 17.10, 18.04
• Mozilla Firefox: before 60.0 — fixed in 60.0

How to fix

Upgrade to a fixed version: Mozilla Firefox 60.0. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/104139
• http://www.securitytracker.com/id/1040896
• https://bugzilla.mozilla.org/show_bug.cgi?id=1426353
• https://usn.ubuntu.com/3645-1/
• https://www.mozilla.org/security/advisories/mfsa2018-11/
• http://www.securityfocus.com/bid/104139
• http://www.securitytracker.com/id/1040896
• https://bugzilla.mozilla.org/show_bug.cgi?id=1426353
• https://usn.ubuntu.com/3645-1/
• https://www.mozilla.org/security/advisories/mfsa2018-11/

Get alerted when CVE-2018-5163 or the next vulnerability affects your stack