CVE-2018-5169: Canonical Ubuntu Linux

Medium severity, CVSS 6.5. EPSS: 1.4% chance of exploitation in the next 30 days.

If manipulated hyperlinked text with "chrome:" URL contained in it is dragged and dropped on the "home" icon, the home page can be reset to include a normally-unlinkable chrome page as one of the home page tabs. This vulnerability affects Firefox < 60.

Affected products

• Canonical Ubuntu Linux: version 14.04 only; version 16.04 only; version 17.10 only; version 18.04 only
• Mozilla Firefox: before 60.0 (fixed in 60.0)

Published 2018-06-11. Last modified 2026-06-17.