Cross-Origin Frame Injection Vulnerability in Firefox WebExtensions

CVE-2018-5116 · HIGH Severity

AV:N/AC:L/AU:N/C:P/I:P/A:P

WebExtensions with the "ActiveTab" permission are able to access frames hosted within the active tab even if the frames are cross-origin. Malicious extensions can inject frames from arbitrary origins into the loaded page and then interact with them, bypassing same-origin user expectations with this permission. This vulnerability affects Firefox < 58.

Learn more about our User Device Pen Test.