An audio capture session can started under an incorrect origin from the site making the capture request.

published 2018-06-11 8y ago modified 2026-06-17 4mo ago also EUVD-2018-16895

cvss: 5.3; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 49%
public exploits: 0; none known

An audio capture session can started under an incorrect origin from the site making the capture request. Users are still prompted to allow the request but the prompt can display the wrong origin, leading to user confusion about which site is making the request to capture an audio stream. This vulnerability affects Firefox < 58.

Patch / fix

fixed in 1 distros 2

Mozilla Firefox 58

ubuntu opensuse

firefox Ubuntu 14.04 LTS 58.0+build6-0ubuntu0.14.04.1
firefox Ubuntu 16.04 LTS 58.0+build6-0ubuntu0.16.04.1
firefox Ubuntu 18.04 LTS 59.0.1+build1-0ubuntu1

ubuntu advisories UBUNTU-CVE-2018-5109

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

firefox-esr openSUSE Tumbleweed 128.5.1-1.1
MozillaFirefox openSUSE Tumbleweed 92.0-1.2

opensuse advisories openSUSE-SU-2024:14572-1 openSUSE-SU-2024:10600-1

Is CVE-2018-5109 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

0.60% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.0	5.3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected products

Mozilla Firefox

Classification

Weakness

CWE-346 Origin Validation Error

References

usn.ubuntu.com /3544-1/
vendor-advisory, third-party-advisory
mozilla.org /security/advisories/mfsa2018-02/
vendor-advisory
bugzilla.mozilla.org /show_bug.cgi?id=1405599
issue-tracking, permissions-required
securitytracker.com /id/1040270
vdb-entry, third-party-advisory
securityfocus.com /bid/102786
vdb-entry, third-party-advisory

Sources

CVE List CVE-2018-5109
NVD CVE-2018-5109

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.