description: By rewriting the Host: request headers using the webRequest API, a WebExtension can bypass domain restrictions through domain fronting. This would allow access to domains that share a host that are otherwise restricted. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.
problem types: WebExtension bypass of domain restrictions through header rewriting
affected:
{
product: Firefox ESR
vendor: Mozilla
versions:
lessThan: 60.3, status: affected, version: unspecified, versionType: custom
}
{
product: Firefox
vendor: Mozilla
versions:
lessThan: 63, status: affected, version: unspecified, versionType: custom
}
