description: The "browser.identity.launchWebAuthFlow" function of WebExtensions is only allowed to load content over "https:" but this requirement was not properly enforced. This can potentially allow privileged pages to be loaded by the extension. This vulnerability affects Firefox < 58.
problem types: WebExtensions can load non-HTTPS pages with browser.identity.launchWebAuthFlow
affected:
{
product: Firefox
vendor: Mozilla
versions:
lessThan: 58, status: affected, version: unspecified, versionType: custom
}