CVE-2018-12402

The internal WebBrowserPersist code does not use correct origin context for a resource being saved. This manifests when sub-resources are loaded as part of "Save Page As..." functionality. For example, a malicious page could recover a visitor's Windows username and NTLM hash by including resources otherwise unreachable to the malicious page, if they can convince the visitor to save the complete web page. Similarly, SameSite cookies are sent on cross-origin requests when the "Save Page As..." menu item is selected to save a page, which can result in saving the wrong version of resources based on those cookies. This vulnerability affects Firefox < 63.

• CWE-346

• http://www.securityfocus.com/bid/105721Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1041944Third Party Advisory, VDB Entry
• https://bugzilla.mozilla.org/show_bug.cgi?id=1447087Issue Tracking, Permissions Required, Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1469916Issue Tracking, Permissions Required, Vendor Advisory
• https://usn.ubuntu.com/3801-1/Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-26/Vendor Advisory
• http://www.securityfocus.com/bid/105721Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1041944Third Party Advisory, VDB Entry
• https://bugzilla.mozilla.org/show_bug.cgi?id=1447087Issue Tracking, Permissions Required, Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1469916Issue Tracking, Permissions Required, Vendor Advisory
• https://usn.ubuntu.com/3801-1/Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-26/Vendor Advisory

Published

Feb 28, 2019

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-12397A WebExtension can request access to local files without the…
• CVE-2018-12398By using the reflected URL in some special resource URIs, su…
• CVE-2018-12399When a new protocol handler is registered, the API accepts a…
• CVE-2018-1240Dell EMC ViPR Controller, versions after 3.0.0.38, contain a…
• CVE-2018-12400In private browsing mode on Firefox for Android, favicons ar…
• CVE-2018-12401Some special resource URIs will cause a non-exploitable cras…
• CVE-2018-12403If a site is loaded over a HTTPS connection but loads a favi…
• CVE-2018-12404A cached side channel attack during handshakes using RSA enc…
• CVE-2018-12405Mozilla developers and community members reported memory saf…
• CVE-2018-12406Mozilla developers and community members reported memory saf…
• CVE-2018-12407A buffer overflow occurs when drawing and validating element…
• CVE-2018-12408The BusinessWorks engine component of TIBCO Software Inc.'s …7.5