CVE-2018-5167

Mozilla: Improper linkification of chrome: and javascript: content in web console and JavaScript debugger

Loading…

Severity

Moderate

Red Hat Product Security

4.3

CVSS 3.0

Review impact separately from score.

Published · May 9, 2018

Updated · November 22, 2025

Description

The web console and JavaScript debugger do not sanitize all output that can be hyperlinked. Both will display "chrome:" links as active, clickable hyperlinks in their output. Web sites should not be able to directly link to internal chrome pages. Additionally, the JavaScript debugger will display "javascript:" links, which users could be tricked into clicking by malicious sites. This vulnerability affects Firefox < 60.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.0 · 4.3
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')