CVE-2018-5105

WebExtensions can bypass user prompts to first save and then open an arbitrarily downloaded file. This can result in an executable file running with local user privileges without explicit user consent. This vulnerability affects Firefox < 58.

• http://www.securityfocus.com/bid/102786Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1040270Third Party Advisory, VDB Entry
• https://bugzilla.mozilla.org/show_bug.cgi?id=1390882Issue Tracking, Permissions Required
• https://usn.ubuntu.com/3544-1/Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-02/Vendor Advisory
• http://www.securityfocus.com/bid/102786Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1040270Third Party Advisory, VDB Entry
• https://bugzilla.mozilla.org/show_bug.cgi?id=1390882Issue Tracking, Permissions Required
• https://usn.ubuntu.com/3544-1/Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-02/Vendor Advisory

Published

Jun 11, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-5099A use-after-free vulnerability can occur when the widget lis…
• CVE-2018-5100A use-after-free vulnerability can occur when arguments pass…
• CVE-2018-5101A use-after-free vulnerability can occur when manipulating f…
• CVE-2018-5102A use-after-free vulnerability can occur when manipulating H…
• CVE-2018-5103A use-after-free vulnerability can occur during mouse event …
• CVE-2018-5104A use-after-free vulnerability can occur during font face ma…
• CVE-2018-5106Style editor traffic in the Developer Tools can be routed th…
• CVE-2018-5107The printing process can bypass local access protections to …
• CVE-2018-5108A Blob URL can violate origin attribute segregation, allowin…
• CVE-2018-5109An audio capture session can started under an incorrect orig…
• CVE-2018-5110If cursor visibility is toggled by script using from 'none' …
• CVE-2018-5111When the text of a specially formatted URL is dragged to the…