CVE-2018-12398

By using the reflected URL in some special resource URIs, such as chrome:, it is possible to inject stylesheets and bypass Content Security Policy (CSP). This vulnerability affects Firefox < 63.

• http://www.securityfocus.com/bid/105721Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1041944Third Party Advisory, VDB Entry
• https://bugzilla.mozilla.org/show_bug.cgi?id=1460538Issue Tracking, Permissions Required, Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1488061Issue Tracking, Permissions Required, Vendor Advisory
• https://usn.ubuntu.com/3801-1/Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-26/Vendor Advisory
• http://www.securityfocus.com/bid/105721Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1041944Third Party Advisory, VDB Entry
• https://bugzilla.mozilla.org/show_bug.cgi?id=1460538Issue Tracking, Permissions Required, Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1488061Issue Tracking, Permissions Required, Vendor Advisory
• https://usn.ubuntu.com/3801-1/Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-26/Vendor Advisory

Published

Feb 28, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-12391During HTTP Live Stream playback on Firefox for Android, aud…
• CVE-2018-12392When manipulating user events in nested loops while opening …
• CVE-2018-12393A potential vulnerability was found in 32-bit builds where a…
• CVE-2018-12395By rewriting the Host: request headers using the webRequest …
• CVE-2018-12396A vulnerability where a WebExtension can run content scripts…
• CVE-2018-12397A WebExtension can request access to local files without the…
• CVE-2018-12399When a new protocol handler is registered, the API accepts a…
• CVE-2018-1240Dell EMC ViPR Controller, versions after 3.0.0.38, contain a…
• CVE-2018-12400In private browsing mode on Firefox for Android, favicons ar…
• CVE-2018-12401Some special resource URIs will cause a non-exploitable cras…
• CVE-2018-12402The internal WebBrowserPersist code does not use correct ori…
• CVE-2018-12403If a site is loaded over a HTTPS connection but loads a favi…