Mozilla: Lightweight themes can be installed without user interaction

Sites can bypass security checks on permissions to install lightweight themes by manipulating the "baseURI" property of the theme element. This could allow a malicious site to install a theme without user interaction which could contain offensive or embarrassing images. This vulnerability affects...

PT-2018-3042

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 52.8 Thunderbird ESR versions prior to 52.8 Firefox versions prior to 60 Firefox ESR versions prior to 52.8 Description The issue is related to the manipulation of the baseURI property of the theme element, allowi...