CVE-2018-18499: Mozilla Firefox

Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days.

A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv="refresh" on a page to cause a redirection to another site using performance.getEntries(). This is a same-origin policy violation and could allow for data theft. This vulnerability affects Firefox < 62, Firefox ESR < 60.2, and Thunderbird < 60.2.1.

Affected products

• Mozilla Firefox: before 62.0 (fixed in 62.0)
• Mozilla Firefox ESR: before 60.2 (fixed in 60.2)
• Mozilla Thunderbird: before 60.2.1 (fixed in 60.2.1)

Published 2019-02-28. Last modified 2026-06-17.