CVE-2018-18500

CVE-2018-18500 is a critical use-after-free vulnerability affecting Mozilla Firefox, Firefox ESR, and Thunderbird versions prior to 65 and 60.5 respectively. This flaw occurs when parsing an HTML5 stream with custom HTML elements, leading to a potentially exploitable crash due to the stream parser object being freed prematurely. With a CVSS score of 9.8 (CRITICAL), it presents a high risk of complete compromise (confidentiality, integrity, availability) without user interaction, although its EPSS and FAUCET scores indicate a moderate likelihood of exploitation. Currently, there is no evidence of active exploitation, nor are there public exploit modules available in Metasploit, Nuclei, or ExploitDB, and it is not listed on CISA's KEV catalog. Community discussion and media coverage are minimal, suggesting limited public awareness or active threat intelligence surrounding this specific vulnerability.