Description
A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv="refresh" on a page to cause a redirection to another site using performance.getEntries(). This is a same-origin policy violation and could allow for data theft. This vulnerability affects Firefox < 62, Firefox ESR < 60.2, and Thunderbird < 60.2.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mozilla | Firefox | unspecified – < 62 | 62 |
| Mozilla | Firefox ESR | unspecified – < 60.2 | 60.2 |
| Mozilla | Thunderbird | unspecified – < 60.2.1 | 60.2.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | firefox-esr | 60.2.0esr-1 | — |
| Debian 14 | thunderbird | 1:60.2.1-1 | — |
| Debian 13 | firefox-esr | 60.2.0esr-1 | — |
| Debian 13 | thunderbird | 1:60.2.1-1 | — |
| Debian 12 | firefox-esr | 60.2.0esr-1 | — |
| Debian 12 | thunderbird | 1:60.2.1-1 | — |
| Debian 9 | firefox-esr | 60.2.0esr-1~deb9u2 | DSA-4287-1 |
| Debian 9 | thunderbird | 1:60.2.1-2~deb9u1 | DSA-4327-1 |
| Debian 8 | firefox-esr | 60.3.0esr-1~deb8u1 | DLA-1571-1 |
| Debian 8 | thunderbird | 1:60.3.0-1~deb8u1 | DLA-1575-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | mozjs52 | No fix yet | — |
| Ubuntu 18.04 LTS | mozjs38 +1 | No fix yet | — |
| Ubuntu 18.04 LTS | thunderbird | 1:60.2.1+build1-0ubuntu0.18.04.2 | — |
| Ubuntu 16.04 LTS | firefox | 62.0+build2-0ubuntu0.16.04.3 | — |
| Ubuntu 16.04 LTS | thunderbird | 1:60.2.1+build1-0ubuntu0.16.04.4 | — |
| Ubuntu 14.04 LTS | thunderbird | 1:60.2.1+build1-0ubuntu0.14.04.2 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | firefox | 60.2.0-1.el7_5 | RHSA-2018:2692 |
| RHEL 7 | thunderbird | 60.2.1-4.el7_5 | RHSA-2018:3458 |
| RHEL 6 | firefox | 60.2.0-1.el6 | RHSA-2018:2693 |
| RHEL 6 | thunderbird | 60.2.1-5.el6 | RHSA-2018:3403 |
Advisories 8
- RHSA-2018:3458 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2018:3403 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2018:2692 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2018:2693 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-4287-1 firefox-esr - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-4327-1 thunderbird - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1571-1 firefox-esr - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1575-1 thunderbird - security update Debian Security (DSA / DLA) · Mar 9, 2026