Bug 1576252 (CVE-2018-5152) - CVE-2018-5152 Mozilla: WebExtensions information leak through webRequest API
Summary: CVE-2018-5152 Mozilla: WebExtensions information leak through webRequest API
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2018-5152
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1573375
TreeView+ depends on / blocked
 
Reported: 2018-05-09 07:12 UTC by Doran Moppert
Modified: 2021-02-17 00:21 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-06-10 10:21:46 UTC


Attachments (Terms of Use)

Description Doran Moppert 2018-05-09 07:12:06 UTC
WebExtensions with the appropriate permissions can attach content scripts to Mozilla sites such as accounts.firefox.com and listen to network traffic to the site through the `webRequest` API. For example, this allows for the interception of username and an encrypted password during login to Firefox Accounts. This issue does not expose synchronization traffic directly and is limited to the process of user login to the website and the data displayed to the user once logged in.



External Reference:

https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5152

Comment 1 Doran Moppert 2018-05-09 07:12:11 UTC
Acknowledgments:

Name: the Mozilla project
Upstream: Andy McKay


Note You need to log in before you can comment on or make changes to this bug.