Security restrictions bypass in Mozilla Firefox - CVE-2018-12369

Vulnerability identifier: #VU13491

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-12369

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to WebExtensions bundled with embedded experiments were not correctly checked for proper authorization. A remote attacker can use a malicious WebExtension to bypass security restrictions and gain full browser permissions.

Mozilla Firefox
Firefox ESR
Arch Linux
Gentoo Linux
Ubuntu
openSUSE Leap
firefox (Ubuntu package)

Update to version 61.0.

Mozilla Firefox - update to 61.0
firefox (Ubuntu package) - addressed in versions 61.0+build3-0ubuntu0.14.04.2, 61.0+build3-0ubuntu0.16.04.2, 61.0+build3-0ubuntu0.17.10.1, 61.0+build3-0ubuntu0.18.04.1

• https://www.mozilla.org/en-US/security/advisories/mfsa2018-15/

• Multiple vulnerabilities in Mozilla Firefox
• Multiple vulnerabilities in Mozilla Firefox ESR
• Arch Linux update for firefox
• OpenSUSE Linux update for MozillaFirefox
• Gentoo update for Mozilla Firefox
• Ubuntu update for firefox