CVE-2018-12358

Service workers can use redirection to avoid the tainting of cross-origin resources in some instances, allowing a malicious site to read responses which are supposed to be opaque. This vulnerability affects Firefox < 61.

• CWE-200

• http://www.securitytracker.com/id/1041193Third Party Advisory, VDB Entry
• https://bugzilla.mozilla.org/show_bug.cgi?id=1467852Issue Tracking, Permissions Required
• https://security.gentoo.org/glsa/201810-01Mitigation, Third Party Advisory
• https://usn.ubuntu.com/3705-1/Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-15/Vendor Advisory
• http://www.securitytracker.com/id/1041193Third Party Advisory, VDB Entry
• https://bugzilla.mozilla.org/show_bug.cgi?id=1467852Issue Tracking, Permissions Required
• https://security.gentoo.org/glsa/201810-01Mitigation, Third Party Advisory
• https://usn.ubuntu.com/3705-1/Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-15/Vendor Advisory

Published

Oct 18, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1235Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoi…
• CVE-2018-12353Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name fie…
• CVE-2018-12354Knowage (formerly SpagoBI) 6.1.1 allows CSRF via every form,…
• CVE-2018-12355Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name or …6.1
• CVE-2018-12356An issue was discovered in password-store.sh in pass in Simp…
• CVE-2018-12357Arista CloudVision Portal through 2018.1.1 has Incorrect Per…
• CVE-2018-12359A buffer overflow can occur when rendering canvas content wh…
• CVE-2018-1236Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-12360A use-after-free vulnerability can occur when deleting an in…
• CVE-2018-12361An integer overflow can occur in the SwizzleData code while …
• CVE-2018-12362An integer overflow can occur during graphics operations don…
• CVE-2018-12363A use-after-free vulnerability can occur when script uses mu…