CVE-2018-12358

What it actually does

A service worker can leverage HTTP redirection to bypass cross-origin tainting checks, exposing the contents of responses that should remain opaque to the requesting origin.

Why it matters to the business

Attackers on malicious websites can obtain limited sensitive data from other sites that users visit, potentially exposing personal information or session details without user consent.

How an attack unfolds

An attacker hosts a malicious page that registers a service worker; when the victim visits, the worker issues a cross-origin request followed by a redirect that evades tainting, allowing the attacker to read the response body.

How to fix it

Upgrade Mozilla Firefox to version 61 or later. For Ubuntu systems, apply the corresponding Firefox package updates from Canonical repositories once available for the affected release.

How to confirm the fix worked

Confirm Firefox version is 61 or higher via about:support or package manager; retest cross-origin service-worker fetches to ensure responses remain opaque.

Typical attack path

1. Victim visits attacker-controlled site
2. Site registers a malicious service worker
3. Worker performs cross-origin fetch with redirect to target resource
4. Tainting bypass allows reading of normally opaque response
5. Data exfiltrated to attacker server

How to detect it

Review browser telemetry or proxy logs for unusual service-worker registrations followed by cross-origin redirects to sensitive endpoints; no public exploitation artifacts are known.

What your security team should do

• Prioritize browser updates across all endpoints within 30 days
• Enable automatic updates for Firefox where possible
• Monitor vendor advisories for any backported fixes on long-term support releases