CVE-2018-12370

Mozilla: SameSite cookie protections bypassed when exiting Reader View

Loading…

Severity

Low

Red Hat Product Security

8.8

CVSS 3.0

Review impact separately from score.

Published · June 26, 2018

Updated · November 22, 2025

Description

In Reader View SameSite cookie protections are not checked on exiting. This allows for a payload to be triggered when Reader View is exited if loaded by a malicious site while Reader mode is active, bypassing CSRF protections. This vulnerability affects Firefox < 61.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.0 · 8.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-829 · Inclusion of Functionality from Untrusted Control Sphere