CVE-2016-9073

WebExtensions can bypass security checks to load privileged URLs and potentially escape the WebExtension sandbox. This vulnerability affects Firefox 50...

CVE-2016-9075

An issue where WebExtensions can use the mozAddonManager API to elevate privilege due to privileged pages being allowed in the permissions list. This allows a malicious extension to then install additional extensions without explicit user permission. This vulnerability affects Firefox 50...

CVE-2018-5105

CVE-2018-5105 affects Firefox before 58. WebExtensions can bypass prompts to first save and then open a downloaded file, enabling an executable to run with local user privileges without explicit consent. Remedy: upgrade Firefox to 58 or later (addressed in the MFSA advisory).

CVE-2016-9073

CVE-2016-9073 : In Firefox, the WebExtensions API window.create schema did not specify format: 'relativeUrl', enabling a WebExtension to load privileged URLs and potentially escape the WebExtension sandbox. Affected: Firefox before 50.0. Impact is sandbox escape and elevation of privilege for ext...

CVE-2017-7816

CVE-2017-7816 affects Mozilla Firefox versions before 56.0. WebExtensions could use popups or panels in the extension UI to load an "about:" privileged URL, bypassing security checks that disallow this behavior. Root cause: the extension UI could navigate to a privileged page, enabling potential ...

CVE-2017-7821

CVE-2017-7821 : A vulnerability in Firefox (WebExtensions) allows downloading and attempting to open certain non-executable file types without user interaction, potentially triggering vulnerabilities in handlers for those document types. The issue affects Firefox versions older than 56 (per mfsa2...

CVE-2018-5134

CVE-2018-5134 affects Mozilla Firefox versions older than 59.0. WebExtensions could use view-source: URLs to access local file: URLs and content in about:cache, bypassing content restrictions. This is described as a WebExtensions content-exposure issue. The numbered references indicate the adviso...

CVE-2018-5135

CVE-2018-5135 affects Mozilla Firefox versions earlier than 59.0. The issue allows WebExtensions to bypass normal restrictions and use browser.tabs.executeScript to inject scripts into contexts where injection should not be allowed (e.g., other WebExtensions or unprivileged about: pages). This is...

CVE-2016-9075

CVE-2016-9075 : Firefox WebExtensions can misuse mozAddonManager API to elevate privileges because privileged pages are allowed in the permissions list, enabling a malicious extension to install additional extensions without explicit user permission. Affected: Firefox versions before 50. Root cau...

CVE-2018-5116

The CVE-2018-5116 entry concerns Mozilla Firefox prior to version 58.0 where WebExtensions with the ActiveTab permission can access cross-origin frames within the active tab, allowing malicious extensions to inject and interact with frames from arbitrary origins and bypass same-origin expectation...

CVE-2018-5132

CVE-2018-5132 : The Find API for WebExtensions in Firefox can search privileged pages (for example, about:debugging) when those pages are open in a tab, potentially exposing protected data. Affected products/versions: Firefox

CVE-2018-5152

WebExtensions with the appropriate permissions can attach content scripts to Mozilla sites such as accounts.firefox.com and listen to network traffic to the site through the "webRequest" API. For example, this allows for the interception of username and an encrypted password during login to Firef...

CVE-2018-5116

WebExtensions with the "ActiveTab" permission are able to access frames hosted within the active tab even if the frames are cross-origin. Malicious extensions can inject frames from arbitrary origins into the loaded page and then interact with them, bypassing same-origin user expectations with th...

CVE-2017-7816

WebExtensions could use popups and panels in the extension UI to load an "about:" privileged URL, violating security checks that disallow this behavior. This vulnerability affects Firefox 56...

CVE-2018-5166

CVE-2018-5166 affects Firefox

CVE-2018-5152

WebExtensions with the appropriate permissions can attach content scripts to Mozilla sites such as accounts.firefox.com and listen to network traffic to the site through the "webRequest" API. For example, this allows for the interception of username and an encrypted password during login to Firef...

CVE-2018-5166

WebExtensions can use request redirection and a "filterReponseData" filter to bypass host permission settings to redirect network traffic and access content from a host for which they do not have explicit user permission. This vulnerability affects Firefox 60...

CVE-2018-5152

CVE-2018-5152 affects Firefox before 60. WebExtensions with appropriate permissions can inject content scripts into sites like accounts.firefox.com and monitor traffic via webRequest, enabling interception during login and exposure of username and encrypted password. The issue is limited to the l...

CVE-2018-5132

The Find API for WebExtensions can search some privileged pages, such as "about:debugging", if these pages are open in a tab. This could allow a malicious WebExtension to search for otherwise protected data if a user has it open. This vulnerability affects Firefox 59...

CVE-2018-5105

WebExtensions can bypass user prompts to first save and then open an arbitrarily downloaded file. This can result in an executable file running with local user privileges without explicit user consent. This vulnerability affects Firefox 58...