We responsibly disclosed the issue to Mozilla and to the Tor Project. Mozilla has quickly released the fix in Firefox 150 and ESR 140.10.0, and the patch is tracked in Mozilla Bug 2024220. The underlying root cause is inherited by Tor Browser through Gecko’s IndexedDB implementation, so the issue is relevant to both products and to all Firefox-based browsers.
The fix is straightforward in principle: the browser should not expose internal storage ordering that reflects process-scoped state. Canonicalizing or sorting results before returning them removes the entropy and prevents this API from acting as a stable identifier.
post
Great find, great write-up. Such a simple bug (and fix).
Good catch. Very likely not to be exploited in the wild at least until now.
replies:
4 comments in c/privacy@lemmy.ml view that post
Wow. I wonder how many vulns like this are unknown outside of identity broker co's and gov intel orgs. Seems like new ones discovered hella lot.
Turning the WWW into an app platform was a mistake. JS allows so much fuckery.
replies:
1 comment in c/hackernews@lemmy.bestiver.se view that post
Well, at least they have a fix for it:
We responsibly disclosed the issue to Mozilla and to the Tor Project. Mozilla has quickly released the fix in Firefox 150 and ESR 140.10.0, and the patch is tracked in Mozilla Bug 2024220. The underlying root cause is inherited by Tor Browser through Gecko’s IndexedDB implementation, so the issue is relevant to both products and to all Firefox-based browsers.
The fix is straightforward in principle: the browser should not expose internal storage ordering that reflects process-scoped state. Canonicalizing or sorting results before returning them removes the entropy and prevents this API from acting as a stable identifier.
all 4 comments