Collected research

CVE-2018-5175: Universal CSP strict-dynamic bypass in Firefox

Masato Kinugawa · mksben.l0.cm

Firefox exposed a bundled require.js through a web-accessible resource URI, and browser extension resources are loaded regardless of a page's Content Security Policy. Any site protected by script-src strict-dynamic could therefore have its policy bypassed from a simple HTML injection, turning it into full script execution.

Record

Researcher

Masato Kinugawa

Published by

mksben.l0.cm

Format

Advisory

Topic

XSS

In the archive

• Collected in the 2016–17 research round
• Collected in the 2018 research round

Related sources

• Cure53 CNY XSS Challenge 2018 Code

Tags

• csp
• xss
• gadget-chain
• filter-bypass
• browser-extension
• javascript
• cve
• owasp-a03-2021
• owasp-a05-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Masato Kinugawa, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.