CVE-2018-5179
published 2019-04-26CVE-2018-5179: A service worker can send the activate event on itself periodically which allows it to run perpetually, allowing it to monitor activity by users. Affects all…
PriorityP341high7.5CVSS 3.0
AVNACLPRNUINSUCHINAN
EPSS
1.49%
71.2th percentile
A service worker can send the activate event on itself periodically which allows it to run perpetually, allowing it to monitor activity by users. Affects all versions prior to Firefox 60.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | firefox | < 60.0 | 60.0 |
| mozilla | firefox | — | — |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-8j5m-6wvx-8fqm: A service worker can send the activate event on itself periodically which allows it to run perpetually, allowing it to monitor activity by users
ghsa_unreviewed·2022-05-24
CVE-2018-5179 [HIGH] CWE-772 GHSA-8j5m-6wvx-8fqm: A service worker can send the activate event on itself periodically which allows it to run perpetually, allowing it to monitor activity by users
A service worker can send the activate event on itself periodically which allows it to run perpetually, allowing it to monitor activity by users. Affects all versions prior to Firefox 60.
OSV
CVE-2018-5179: A service worker can send the activate event on itself periodically which allows it to run perpetually, allowing it to monitor activity by users
osv·2019-04-26·CVSS 7.5
CVE-2018-5179 [HIGH] CVE-2018-5179: A service worker can send the activate event on itself periodically which allows it to run perpetually, allowing it to monitor activity by users
A service worker can send the activate event on itself periodically which allows it to run perpetually, allowing it to monitor activity by users. Affects all versions prior to Firefox 60.
Red Hat
chromium-browser: Lack of limits on update() in ServiceWorker
vendor_redhat·2018-10-16·CVSS 7.5
CVE-2018-5179 [HIGH] chromium-browser: Lack of limits on update() in ServiceWorker
chromium-browser: Lack of limits on update() in ServiceWorker
A service worker can send the activate event on itself periodically which allows it to run perpetually, allowing it to monitor activity by users. Affects all versions prior to Firefox 60.
No detection rules found.
No public exploits indexed.
2019-04-26
Published