CVE-2018-5113

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 58

Description: The issue is related to the browser.identity.launchWebAuthFlow function of WebExtensions, which is supposed to only load content over https:. However, this requirement was not properly enforced, potentially allowing privileged pages to be loaded by the extension. This could enable a remote attacker to gain unauthorized access to protected information.

Recommendations: For versions prior to 58, update to a version that properly enforces the https: requirement for the browser.identity.launchWebAuthFlow function. As a temporary workaround, consider restricting the use of the browser.identity.launchWebAuthFlow function until a patch is available.