A vulnerability in the notifications Push API where notifications can be sent through service workers by web content without direct user interaction. This could be used to open new tabs in a denial of service (DOS) attack or to display unwanted content from arbitrary URLs to users. This vulnerability affects Firefox < 59.
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade thunderbirdUpgrade libxulUpgrade linux-firefoxUpgrade firefoxUpgrade seamonkeyUpgrade waterfoxUpgrade firefox-esrUpgrade linux-thunderbirdUpgrade linux-seamonkey | Dec 10, 2025 | Mar 13, 2018 |
| Mfsa2018 06 | — | Upgrade to Mozilla Firefox version 59.0Upgrade to the latest version of Mozilla Firefox | Jul 12, 2018 | Jun 11, 2018 |
| Suse | — | Upgrade MozillaFirefox-translations-commonUpgrade MozillaFirefoxUpgrade MozillaFirefox-translations-other | May 20, 2018 | Mar 14, 2018 |
| Ubuntu | — | Upgrade firefox | Apr 26, 2018 | Mar 14, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub