CVE-2018-5182

If a text string that happens to be a filename in the operating system's native format is dragged and dropped onto the addressbar the specified local file will be opened. This is contrary to policy and is what would happen if the string were the equivalent "file:" URL. This vulnerability affects Firefox < 60.

• CWE-200

• http://www.securityfocus.com/bid/104139Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1040896Third Party Advisory, VDB Entry
• https://bugzilla.mozilla.org/show_bug.cgi?id=1435908Issue Tracking, Permissions Required, Vendor Advisory
• https://usn.ubuntu.com/3645-1/Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-11/Vendor Advisory
• http://www.securityfocus.com/bid/104139Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1040896Third Party Advisory, VDB Entry
• https://bugzilla.mozilla.org/show_bug.cgi?id=1435908Issue Tracking, Permissions Required, Vendor Advisory
• https://usn.ubuntu.com/3645-1/Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-11/Vendor Advisory

Published

Jun 11, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-5176The JSON Viewer displays clickable hyperlinks for strings th…
• CVE-2018-5177A vulnerability exists in XSLT during number formatting wher…
• CVE-2018-5178A buffer overflow was found during UTF8 to Unicode string co…
• CVE-2018-5179A service worker can send the activate event on itself perio…
• CVE-2018-5180A use-after-free vulnerability can occur during WebGL operat…
• CVE-2018-5181If a URL using the "file:" protocol is dragged and dropped o…
• CVE-2018-5183Mozilla developers backported selected changes in the Skia l…
• CVE-2018-5184Using remote content in encrypted messages can lead to the d…
• CVE-2018-5185Plaintext of decrypted emails can leak through by user submi…
• CVE-2018-5186Memory safety bugs present in Firefox 60. Some of these bugs…
• CVE-2018-5187Memory safety bugs present in Firefox 60 and Firefox ESR 60.…
• CVE-2018-5188Memory safety bugs present in Firefox 60, Firefox ESR 60, an…