CVE-2018-12400

In private browsing mode on Firefox for Android, favicons are cached in the cache/icons folder as they are in non-private mode. This allows information leakage of sites visited during private browsing sessions. *Note: this issue only affects Firefox for Android. Desktop versions of Firefox are unaffected.*. This vulnerability affects Firefox < 63.

• CWE-200

• http://www.securityfocus.com/bid/105721Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1041944Third Party Advisory, VDB Entry
• https://bugzilla.mozilla.org/show_bug.cgi?id=1448305Issue Tracking, Permissions Required, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-26/Vendor Advisory
• http://www.securityfocus.com/bid/105721Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1041944Third Party Advisory, VDB Entry
• https://bugzilla.mozilla.org/show_bug.cgi?id=1448305Issue Tracking, Permissions Required, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-26/Vendor Advisory

Published

Feb 28, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-12395By rewriting the Host: request headers using the webRequest …
• CVE-2018-12396A vulnerability where a WebExtension can run content scripts…
• CVE-2018-12397A WebExtension can request access to local files without the…
• CVE-2018-12398By using the reflected URL in some special resource URIs, su…
• CVE-2018-12399When a new protocol handler is registered, the API accepts a…
• CVE-2018-1240Dell EMC ViPR Controller, versions after 3.0.0.38, contain a…
• CVE-2018-12401Some special resource URIs will cause a non-exploitable cras…
• CVE-2018-12402The internal WebBrowserPersist code does not use correct ori…
• CVE-2018-12403If a site is loaded over a HTTPS connection but loads a favi…
• CVE-2018-12404A cached side channel attack during handshakes using RSA enc…
• CVE-2018-12405Mozilla developers and community members reported memory saf…
• CVE-2018-12406Mozilla developers and community members reported memory saf…