#VU13479 Use-after-free error in Mozilla Firefox

Published: 2018-06-27

Vulnerability identifier: #VU13479

Vulnerability risk: High


CVE-ID: CVE-2018-12360


Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Mozilla Firefox
Client/Desktop applications / Web browsers

Vendor: Mozilla


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to use-after-free vulnerability when deleting an input element during a mutation event handler triggered by focusing that element. A remote unauthenticated attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code with elevated privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Update to version 61.0.

Vulnerable software versions

Mozilla Firefox: 60.0 - 60.0.2


External links

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

Latest bulletins with this vulnerability