CWE Code: 20
Vulnerability Type: privilege_escalation
CVSS Score: 4.3
CWE Name:  Improper Input Validation
Summary: limitations on the uris allowed to webextensions by the browser.windows.create api can be bypassed when a pipe in the url field is used within the extension to load multiple pages as a single argument. this could allow a malicious webextension to open privileged about: or file: locations. this vulnerability affects firefox < 64.
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/NONE/NONE
Published Date: 2019-02-28
Last Modified Date: 2019-03-01