description: WebExtensions could use the "mozAddonManager" API by modifying the CSP headers on sites with the appropriate permissions and then using host requests to redirect script loads to a malicious site. This allows a malicious extension to then install additional extensions without explicit user permission. This vulnerability affects Firefox < 51.
problem types: WebExtensions can install additional add-ons via modified host requests
affected:
{
product: Firefox
vendor: Mozilla
versions:
lessThan: 51, status: affected, version: unspecified, versionType: custom
}