CVE-2017-7843
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 3.0%
exploitation probability
3.0%top 13% of all CVEs
observed exploitation
nono source reports it
When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this stored data will persist across multiple private browsing mode sessions because it is not cleared when exiting. This vulnerability affects Firefox ESR < 52.5.2 and Firefox < 57.0.1.
References
https://access.redhat.com/errata/RHSA-2017:3382https://bugzilla.mozilla.org/show_bug.cgi?id=1410106https://lists.debian.org/debian-lts-announce/2017/12/msg00003.htmlhttps://www.debian.org/security/2017/dsa-4062https://www.mozilla.org/security/advisories/mfsa2017-27/https://www.mozilla.org/security/advisories/mfsa2017-28/http://www.securityfocus.com/bid/102039http://www.securityfocus.com/bid/102112http://www.securitytracker.com/id/1039954