CVE-2018-12398

Al utilizar la URL reflejada, en algunas URI de recurso especiales, como "chrome:", es posible inyectar hojas de estilo y omitir la política de seguridad de contenido (CSP). Esta vulnerabilidad afecta a las versiones anteriores a la 63 de Firefox.

USN-3801-1 fixed vulnerabilities in Firefox. The update introduced various minor regressions. This update fixes the problems. Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, bypass CSP restrictions, spoof the protocol registration notification bar, leak SameSite cookies, bypass mixed content warnings, or execute arbitrary code. Multiple security issues were discovered with WebExtensions in Firefox. If a user were tricked in to installing a specially crafted extension, an attacker could potentially exploit these to bypass domain restrictions, gain additional privileges, or run content scripts in local pages without permission. Various other issues were also addressed.