CVE-2018-5142

If Media Capture and Streams API permission is requested from documents with "data:" or "blob:" URLs, the permission notifications do not properly display the originating domain. The notification states "Unknown protocol" as the requestee, leading to user confusion about which site is asking for this permission. This vulnerability affects Firefox < 59.

• http://www.securityfocus.com/bid/103386Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1040514Third Party Advisory, VDB Entry
• https://bugzilla.mozilla.org/show_bug.cgi?id=1366357Permissions Required
• https://usn.ubuntu.com/3596-1/Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-06/Vendor Advisory
• http://www.securityfocus.com/bid/103386Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1040514Third Party Advisory, VDB Entry
• https://bugzilla.mozilla.org/show_bug.cgi?id=1366357Permissions Required
• https://usn.ubuntu.com/3596-1/Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-06/Vendor Advisory

Published

Jun 11, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-5135WebExtensions can bypass normal restrictions in some circums…
• CVE-2018-5136A shared worker created from a "data:" URL in one tab can be…
• CVE-2018-5137A legacy extension's non-contentaccessible, defined resource…
• CVE-2018-5138A spoofing vulnerability can occur when a malicious site wit…
• CVE-2018-5140Image for moz-icons can be accessed through the "moz-icon:" …
• CVE-2018-5141A vulnerability in the notifications Push API where notifica…
• CVE-2018-5143URLs using "javascript:" have the protocol removed when past…
• CVE-2018-5144An integer overflow can occur during conversion of text to s…
• CVE-2018-5145Memory safety bugs were reported in Firefox ESR 52.6. These …
• CVE-2018-5146An out of bounds memory write while processing Vorbis audio …
• CVE-2018-5147The libtremor library has the same flaw as CVE-2018-5146. Th…
• CVE-2018-5148A use-after-free vulnerability can occur in the compositor d…