CVE-2023-28161 in Firefox
Summary
by MITRE • 06/02/2023
If temporary "one-time" permissions, such as the ability to use the Camera, were granted to a document loaded using a file: URL, that permission persisted in that tab for all other documents loaded from a file: URL. This is potentially dangerous if the local files came from different sources, such as in a download directory. This vulnerability affects Firefox < 111.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 12/02/2025
This vulnerability represents a critical permission persistence flaw in Firefox browsers version 111 and earlier, where temporary one-time permissions granted to documents loaded via file URLs maintain their effect across subsequent documents within the same browser tab. The issue stems from improper handling of permission state management when processing local file resources, creating a persistent security risk that undermines the intended temporary nature of these permissions. The vulnerability specifically impacts how Firefox manages access controls for sensitive system resources such as camera functionality when documents are loaded from local file systems.
The technical flaw occurs at the browser's permission management layer where the system fails to properly isolate permission states between different documents loaded within the same tab context. When a document loaded from a file URL requests and receives temporary permissions, the browser incorrectly maintains these permissions for all subsequent documents accessed through the same file URL mechanism. This creates a scenario where malicious actors could exploit the persistent permission state to gain unauthorized access to system resources across multiple local documents without requiring repeated user consent. The vulnerability demonstrates a failure in proper resource cleanup and state management during document transitions within the same browsing context.
The operational impact of this vulnerability is particularly severe in environments where users frequently access local files from untrusted sources, such as download directories or shared network drives. Attackers could craft malicious documents that, when opened sequentially in the same tab, maintain elevated permissions from previous documents, potentially enabling persistent access to camera feeds, microphone access, or other sensitive hardware resources. This risk is amplified when users regularly access files from different sources without closing tabs, as the permission state persists across all file URL documents within that tab session. The vulnerability essentially creates a permission escalation path that bypasses the intended security boundaries of temporary permissions.
This vulnerability aligns with CWE-284, which addresses improper access control mechanisms, and demonstrates characteristics consistent with privilege escalation attacks within browser contexts. From an ATT&CK perspective, this flaw maps to techniques involving privilege escalation and persistence, specifically targeting the browser's permission model to maintain access across multiple documents. The issue also relates to CWE-693, which covers protection mechanism failures, as the browser's permission system fails to properly enforce the temporary nature of granted access rights. Organizations should prioritize immediate patching of affected Firefox versions to prevent exploitation, while implementing monitoring for suspicious file access patterns and user behavior that might indicate unauthorized permission usage across local documents.