CVE-2018-18497

La API browser.windows.create permitía que las WebExtensions omitiesen las limitaciones en las URI cuando una tubería (pipe) en el campo URL se utiliza con la extensión para cargar múltiples páginas como un solo argumento. Esto podría permitir que un WebExtension malicioso abra las ubicaciones privilegiadas about: o file:. Esta vulnerabilidad afecta a las versiones anteriores a la 64 de Firefox.

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, bypass same-origin restrictions, or execute arbitrary code. Multiple security issues were discovered in WebExtensions. If a user were tricked in to installing a specially crafted extension, an attacker could potentially exploit these to open privileged pages, or bypass other security restrictions. Various other issues were also addressed.