CVEs-PoC/2018/CVE-2018-5113.md

CVE-2018-5113

Description

The "browser.identity.launchWebAuthFlow" function of WebExtensions is only allowed to load content over "https:" but this requirement was not properly enforced. This can potentially allow privileged pages to be loaded by the extension. This vulnerability affects Firefox < 58.

POC

Reference

• https://bugzilla.mozilla.org/show_bug.cgi?id=1425267
• https://bugzilla.mozilla.org/show_bug.cgi?id=1425267

Github

No PoCs found on GitHub currently.