CVE-2018-5105

7.8 highEPSS 0.4%

WebExtensions can bypass user prompts to first save and then open an arbitrarily downloaded file. This can result in an executable file running with local user privileges without explicit user consent. This vulnerability affects Firefox < 58.

Severity

CVSS 3.0

7.8 high

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 35% of CVEs (scores of 2026-10-31)
Published: 2018-06-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

canonical:ubuntu_linux
mozilla:firefox

References

http://www.securityfocus.com/bid/102786
http://www.securitytracker.com/id/1040270
https://bugzilla.mozilla.org/show_bug.cgi?id=1390882
https://usn.ubuntu.com/3544-1/
https://www.mozilla.org/security/advisories/mfsa2018-02/

Check your stack JSON