WebExtension content scripts can be loaded into about: pages in some circumstances, in violation of the permissions granted to extensions. This could allow an extension to interfere with the loading and usage of these pages and use capabilities that were intended to be restricted from extensions. This vulnerability affects Firefox < 64.
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
| Link | Tags |
|---|---|
| https://www.mozilla.org/security/advisories/mfsa2018-29/ | vendor advisory |
| https://bugzilla.mozilla.org/show_bug.cgi?id=1427585 | vendor advisory issue tracking permissions required |
| https://usn.ubuntu.com/3844-1/ | third party advisory vendor advisory |
| http://www.securityfocus.com/bid/106167 | third party advisory vdb entry |