CVE-2017-7843: Infoleak
When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this stored data will persist across multiple private browsing mode sessions because it is not cleared when exiting.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2017-7843?
CVE-2017-7843 is a vulnerability that allows a web worker to write persistent data to IndexedDB in Private Browsing mode, potentially fingerprinting a user uniquely.
Which software is affected by CVE-2017-7843?
Mozilla Firefox versions up to 57.0.1, Mozilla Firefox ESR versions up to 52.5.2, and Debian versions including 118.0.2-1 and certain packages of Firefox-esr are affected by CVE-2017-7843.
What is the severity level of CVE-2017-7843?
CVE-2017-7843 has a severity level of high with a severity value of 7.
How can I fix CVE-2017-7843?
To fix CVE-2017-7843, update Mozilla Firefox to version 57.0.1 or later, Mozilla Firefox ESR to version 52.5.2 or later, or update the affected Debian packages to their respective patched versions.
Where can I find more information about CVE-2017-7843?
You can find more information about CVE-2017-7843 on the following references: [1] [2] [3].