Development Tools panels of an extension are required to load URLs for the panels as relative URLs from the extension manifest file but thi…

published 2018-06-11 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-16898

cvss: 7.5; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.9%; EPSS 1.9% chance of exploitation in 30 days, percentile 80%
public exploits: 0; none known

Development Tools panels of an extension are required to load URLs for the panels as relative URLs from the extension manifest file but this requirement was not enforced in all instances. This could allow the development tools panel for the extension to load a URL that it should not be able to access, including potentially privileged pages. This vulnerability affects Firefox < 58.

Patch / fix

fixed in 1 distros 2

Mozilla Firefox 58

ubuntu opensuse

firefox Ubuntu 14.04 LTS 58.0+build6-0ubuntu0.14.04.1
firefox Ubuntu 16.04 LTS 58.0+build6-0ubuntu0.16.04.1
firefox Ubuntu 18.04 LTS 59.0.1+build1-0ubuntu1

ubuntu advisories UBUNTU-CVE-2018-5112

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

firefox-esr openSUSE Tumbleweed 128.5.1-1.1
MozillaFirefox openSUSE Tumbleweed 92.0-1.2

opensuse advisories openSUSE-SU-2024:14572-1 openSUSE-SU-2024:10600-1

Exploit prediction

1.95% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.0	7.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

Mozilla Firefox

Classification

Weakness

CWE-552 Files or Directories Accessible to External Parties

References

usn.ubuntu.com /3544-1/
vendor-advisory, third-party-advisory
mozilla.org /security/advisories/mfsa2018-02/
vendor-advisory
securitytracker.com /id/1040270
vdb-entry, third-party-advisory
bugzilla.mozilla.org /show_bug.cgi?id=1425224
issue-tracking, permissions-required
securityfocus.com /bid/102786
vdb-entry, third-party-advisory

Sources

CVE List CVE-2018-5112
NVD CVE-2018-5112

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary