The "browser.identity.launchWebAuthFlow" function of WebExtensions is only allowed to load content over "https:" but this requirement was not properly enforced. This can potentially allow privileged pages to be loaded by the extension. This vulnerability affects Firefox < 58.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade linux-thunderbirdUpgrade firefox-esrUpgrade libxulUpgrade waterfoxUpgrade firefoxUpgrade linux-seamonkeyUpgrade thunderbirdUpgrade linux-firefoxUpgrade seamonkey | Dec 10, 2025 | Jan 23, 2018 |
| Mfsa2018 02 | — | Upgrade to Mozilla Firefox version 58.0Upgrade to the latest version of Mozilla Firefox | Jan 24, 2018 | Jan 23, 2018 |
| Suse | — | Upgrade MozillaFirefoxUpgrade MozillaFirefox-translations-commonUpgrade MozillaFirefox-translations-other | May 19, 2018 | Jan 24, 2018 |
| Ubuntu | — | Upgrade firefox | Apr 26, 2018 | Jan 24, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub