Description
When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this stored data will persist across multiple private browsing mode sessions because it is not cleared when exiting. This vulnerability affects Firefox ESR < 52.5.2 and Firefox < 57.0.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mozilla | Firefox ESR | unspecified – < 52.5.2 | 52.5.2 |
| Mozilla | Firefox | unspecified – < 57.0.1 | 57.0.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | firefox-esr | 52.5.2esr-1 | — |
| Debian 13 | firefox-esr | 52.5.2esr-1 | — |
| Debian 12 | firefox-esr | 52.5.2esr-1 | — |
| Debian 9 | firefox-esr | 52.5.2esr-1~deb9u1 | DSA-4062-1 |
| Debian 8 | firefox-esr | 52.5.2esr-1~deb8u1 | DSA-4062-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | firefox-esr | 52.5.2esr-1~deb7u1 | DLA-1202-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | firefox | 57.0.1+build2-0ubuntu1 | — |
| Ubuntu 16.04 LTS | firefox | 57.0.1+build2-0ubuntu0.16.04.1 | — |
| Ubuntu 14.04 LTS | firefox | 57.0.1+build2-0ubuntu0.14.04.1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | firefox | 52.5.1-1.el7_4 | RHSA-2017:3382 |
| RHEL 6 | firefox | 52.5.1-1.el6_9 | RHSA-2017:3382 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | MozillaFirefox | 92.0-1.2 | openSUSE-SU-2024:10600-1 |
| openSUSE Tumbleweed | firefox-esr | 128.5.1-1.1 | openSUSE-SU-2024:14572-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.23 | firefox-esr | 52.5.2-r0 | — |
| Alpine v3.22 | firefox-esr | 52.5.2-r0 | — |
| Alpine v3.21 | firefox-esr | 52.5.2-r0 | — |
| Alpine v3.20 | firefox-esr | 52.5.2-r0 | — |
| Alpine v3.19 | firefox-esr | 52.5.2-r0 | — |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.18 | firefox-esr | 52.5.2-r0 | — |
| Alpine v3.17 | firefox-esr | 52.5.2-r0 | — |
| Alpine v3.16 | firefox-esr | 52.5.2-r0 | — |
| Alpine v3.15 | firefox-esr | 52.5.2-r0 | — |
| Alpine v3.14 | firefox-esr | 52.5.2-r0 | — |
| Alpine v3.13 | firefox-esr | 52.5.2-r0 | — |
| Alpine v3.12 | firefox-esr | 52.5.2-r0 | — |
| Alpine v3.11 | firefox-esr | 52.5.2-r0 | — |
| Alpine v3.10 | firefox-esr | 52.5.2-r0 | — |
| Alpine v3.9 | firefox-esr | 52.5.2-r0 | — |
| Alpine v3.8 | firefox-esr | 52.5.2-r0 | — |
| Alpine v3.7 | firefox-esr | 52.5.2-r0 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | firefox | 52.5.1-1.0.1.el7_4 | ELSA-2017-3382 |
Advisories 6
- RHSA-2017:3382 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-4062-1 firefox-esr - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1202-1 firefox-esr - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10600-1 MozillaFirefox-92.0-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14572-1 firefox-esr-128.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2017-3382 Important: firefox security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Dec 5, 2017
References
- RHSA-2017:3382 vendor-advisory
- [debian-lts-announce] 20171210 [SECURITY] [DLA 1202-1] firefox-esr security update mailing-list
- https://www.mozilla.org/security/advisories/mfsa2017-28/
- 1039954 vdb-entry
- https://www.mozilla.org/security/advisories/mfsa2017-27/
- DSA-4062 vendor-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1410106
- 102039 vdb-entry
- 102112 vdb-entry