Security readout for executives and security teams
Plain-English summary
This issue affects qutebrowser history viewing. A malicious page title could be carried into the browser's internal history page and run JavaScript there, potentially exposing the user's browsing history. The attack requires the user to visit a crafted page and then open qute://history through the history command.
Executive priority
Treat this as a privacy and confidentiality issue for qutebrowser users, not a broad enterprise remote compromise. Remediate promptly where the browser is used, especially by staff handling sensitive research, client, or security work.
Technical view
CVE-2018-1000559 is an XSS flaw in qutebrowser's :history command and qute://history page, introduced in v0.11.0. The CVE states that JavaScript injected through a crafted HTML title could execute when the history page is opened. Fixes are identified in v1.3.3 and v1.4.0 commits.
Likely exposure
Exposure is likely limited to environments where users run qutebrowser versions from v0.11.0 before the fixed v1.3.3 or v1.4.0 releases. The bundled CVE metadata does not provide CPEs, CVSS, or broader affected platform detail.
Exploitation context
The source bundle does not show active exploitation or KEV listing. Exploitation requires user interaction: the victim opens a page with a specially crafted title and later opens qute://history via the :history command.
Researcher notes
The bundle names qutebrowser and the vulnerable internal history surface, but formal affected product fields, CVSS, and CWE are absent. Avoid assuming active exploitation or additional affected products. Validate by version and fixed commit presence rather than offensive reproduction.
Mitigation direction
- Upgrade qutebrowser to v1.3.3, v1.4.0, or a later vendor-maintained release.
- Confirm deployed builds include the referenced fixed commits.
- Review qutebrowser issue 4011 and release guidance for any follow-up notes.
- Prioritize users whose browsing history may expose sensitive client, investigation, or internal sites.
Validation and detection
- Inventory endpoints for qutebrowser installations and versions.
- Flag qutebrowser versions introduced at v0.11.0 and older than v1.3.3.
- Verify the installed package includes commit 4c9360237f186681b1e3f2a0f30c45161cf405c7 or later fix lineage.
- Check whether affected users handled sensitive browsing activity in qutebrowser before remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-1000559 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/qutebrowser/qutebrowser/commit/4c9360237f186681b1e3f2a0f30c45161cf405c7CVE reference · x_refsource_MISC
- https://github.com/qutebrowser/qutebrowser/commit/5a7869f2feaa346853d2a85413d6527c87ef0d9fCVE reference · x_refsource_MISC
- https://github.com/qutebrowser/qutebrowser/issues/4011CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.