vulnerability

MFSA2018-26 Firefox: Security vulnerabilities fixed in Firefox 63 (CVE-2018-12397)

Try Surface Command

Back to search

Severity

CVSS

(AV:L/AC:L/Au:N/C:P/I:P/A:N)

Published

Oct 23, 2018

Added

Oct 24, 2018

Modified

Mar 27, 2026

Description

A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed to the user. This allows extensions to run content scripts in local pages without permission warnings when a local file is opened. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.

Solution

mozilla-firefox-upgrade-63_0

References

CVE-2018-12397
https://attackerkb.com/topics/CVE-2018-12397
CWE-200
EUVD-EUVD-2018-4371
http://www.mozilla.org/security/announce/2018/mfsa2018-26.html
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-4371

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report