Skip to content
OpenAdvisories
Medium · 4.3 CVE-2022-45417 EUVD-2022-48289GHSA-284c-r484-8cqh

Service Workers did not detect Private Browsing Mode correctly in all cases, which could have led to Service Workers being written to disk …

Published Dec 22, 2022 · Updated Apr 15, 2025 · Assigned by mozilla

Vendor: Mozilla Product: Firefox Package: mozjs38 Package: mozjs52 Package: mozjs68 Package: mozjs78 Package: mozjs91 Category: Browsers Ecosystem: Ubuntu

Description

Service Workers did not detect Private Browsing Mode correctly in all cases, which could have led to Service Workers being written to disk for websites visited in Private Browsing Mode. This would not have persisted them in a state where they would run again, but it would have leaked Private Browsing Mode details to disk. This vulnerability affects Firefox < 107.

Affected products

VendorProductAffectedFixed
Mozilla Firefox unspecified – < 107 107

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS mozjs78 +1 No fix yet —
Ubuntu 20.04 LTS firefox 107.0+build2-0ubuntu0.20.04.1 USN-5726-1
Ubuntu 20.04 LTS mozjs52 +1 No fix yet —
Ubuntu 18.04 LTS firefox 107.0+build2-0ubuntu0.18.04.1 USN-5726-1
Ubuntu 18.04 LTS mozjs38 +1 No fix yet —

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed MozillaFirefox 107.0-1.1 openSUSE-SU-2024:12518-1
openSUSE Tumbleweed firefox-esr 128.5.1-1.1 openSUSE-SU-2024:14572-1

Advisories 5

References