VULNERABILITY INTELLIGENCE
CVE-2018-12386
CVSS score8.1 HIGH
EPSS probability13.42%
CISA KEVNot currently listed
Published2018-10-18
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Description
A vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and write. This leads to remote code execution inside the sandboxed content process when triggered. This vulnerability affects Firefox ESR < 60.2.2 and Firefox < 62.0.3.
Weakness classification
- CWE-704: Incorrect Type Conversion or Cast
Primary references
- security@mozilla.org — Third Party Advisory, VDB Entry
- security@mozilla.org — Third Party Advisory, VDB Entry
- security@mozilla.org — Third Party Advisory
- security@mozilla.org — Third Party Advisory
- security@mozilla.org — Exploit, Issue Tracking, Patch, Vendor Advisory
- security@mozilla.org — Third Party Advisory
- security@mozilla.org — Third Party Advisory
- security@mozilla.org — Third Party Advisory
- security@mozilla.org — Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory