CVE-2017-7843 in Firefox
Summary
by MITRE
When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this stored data will persist across multiple private browsing mode sessions because it is not cleared when exiting. This vulnerability affects Firefox ESR < 52.5.2 and Firefox < 57.0.1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/26/2025
This vulnerability represents a critical privacy regression in Mozilla Firefox browsers where the fundamental security boundary of private browsing mode is compromised. The flaw allows web workers to bypass the expected isolation mechanisms that should prevent persistent data storage during private browsing sessions. When users activate private browsing mode, they expect their browser to maintain complete separation between their regular browsing activities and private sessions, including preventing any form of persistent data storage that could track their activities across different browsing contexts. The vulnerability specifically targets the IndexedDB API, which is a client-side storage mechanism that should be explicitly disabled or restricted in private browsing contexts.
The technical implementation of this flaw occurs through the exploitation of web worker execution contexts within private browsing mode. Web workers operate as separate threads that can execute JavaScript code independently of the main browser thread, and they inherit the same security context as their parent browsing session. In this case, the web worker is able to access IndexedDB storage mechanisms despite the private browsing mode restrictions, creating a persistent data store that persists beyond the intended scope of private browsing sessions. This behavior violates the core security model of private browsing mode, which should ensure complete data isolation and prevent any form of tracking or fingerprinting.
The operational impact of this vulnerability extends far beyond simple privacy concerns, as it enables sophisticated tracking mechanisms that can uniquely identify users across multiple browsing sessions. The persistent nature of the IndexedDB storage means that even after a user closes their private browsing session and reopens it, the stored data remains accessible to malicious actors. This creates a persistent fingerprinting capability that can track user behavior, preferences, and potentially sensitive information across different websites and browsing contexts. The vulnerability essentially defeats the purpose of private browsing mode as a privacy protection mechanism, allowing attackers to maintain long-term tracking capabilities that should have been prevented by the browser's security model.
The affected versions represent a significant portion of Firefox installations that were vulnerable to this attack vector, particularly affecting Firefox Extended Support Release versions before 52.5.2 and regular Firefox versions before 57.0.1. This vulnerability aligns with CWE-284 Access Control Issues, specifically targeting improper access control mechanisms that should prevent storage operations in restricted browsing contexts. The attack pattern follows typical techniques described in the ATT&CK framework under T1187 for bypassing security restrictions and T1070 for indicator removal and tracking evasion. Organizations and users who relied on private browsing mode for protection against tracking and fingerprinting were left vulnerable to persistent surveillance mechanisms that could operate silently in the background without user knowledge or consent.
Mitigation strategies should focus on immediate browser updates to patched versions that properly enforce IndexedDB access restrictions in private browsing mode. Users should also implement additional privacy protection measures such as disabling web workers for untrusted sites, using privacy-focused browser extensions, and regularly clearing browsing data even when private browsing mode is intended for use. Security teams should monitor for potential exploitation attempts and consider implementing network-level detection for suspicious IndexedDB access patterns that might indicate this vulnerability being actively exploited in the wild. The incident underscores the importance of comprehensive security testing for browser isolation mechanisms and the need for robust enforcement of security boundaries that prevent bypasses of expected privacy protections.