CVE-2018-18499

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 62 Firefox ESR versions prior to 60.2 Thunderbird versions prior to 60.2.1

Description A same-origin policy violation exists, allowing the theft of cross-origin URL entries. This occurs when a page uses a meta http-equiv="refresh" to cause a redirection to another site, exploiting the performance.getEntries() function. This could enable data theft.

Recommendations For Firefox versions prior to 62, update to version 62 or later to resolve the issue. For Firefox ESR versions prior to 60.2, update to version 60.2 or later to resolve the issue. For Thunderbird versions prior to 60.2.1, update to version 60.2.1 or later to resolve the issue.