CVE-2018-18511

What it actually does

The flaw permits a malicious site to extract pixel data from cross-origin images rendered in a canvas element by abusing transferFromImageBitmap, bypassing same-origin policy checks.

Why it matters to the business

Attackers may obtain images that should remain private to other sites, creating privacy exposure for users of affected browser packages without direct system compromise.

How an attack unfolds

An attacker crafts a page that loads a cross-origin image into a canvas and invokes transferFromImageBitmap to read its contents, sending the extracted data back to the attacker; the issue is limited to specific Firefox 65 builds and downstream Tor packages.

How to fix it

Upgrade tor packages to the listed fixed versions: 0.2.5.11-1 on Debian 11/12/13 and 0.2.4.27-1build0.14.04.1 on Ubuntu 14.04 LTS; ensure the underlying browser engine reaches at least version 65.0.1.

How to confirm the fix worked

Confirm installed tor or browser package versions match or exceed the fixed releases; test that cross-origin canvas reads are blocked after upgrade.

Typical attack path

1. Host a malicious webpage targeting the vulnerable canvas API
2. Trick a user into visiting the page with the affected browser
3. Trigger transferFromImageBitmap on a cross-origin bitmap
4. Exfiltrate the read image data to an attacker-controlled server

How to detect it

Inspect browser version strings in user-agent logs or package inventories for instances older than the fixed releases; no runtime exploitation artifacts are known for this disclosure issue.

What your security team should do

• Prioritize patching tor packages on all Debian and Ubuntu systems within standard maintenance windows
• Verify update deployment via package management logs
• Review browser usage policies for legacy Tor deployments