Mozilla Firefox / Thunderbird

CVE-2026-6770 – IndexedDB Ordering Information Disclosure Leading to Cross-Site Fingerprinting and Tracking

Affects

• Mozilla Firefox
• Mozilla Firefox ESR
• Mozilla Thunderbird
• Versions:
  • Firefox before version 150
  • Firefox ESR before version 140.10
  • Thunderbird before version 150
  • Thunderbird before version 140.10
• Components:
  • Storage: IndexedDB component
• Function:
  • indexedDB.databases()

Description

CVE-2026-6770 is a medium-severity information disclosure vulnerability in Mozilla Firefox and Thunderbird affecting the IndexedDB client-side storage API .

IndexedDB is a browser API used for storing structured data on the client side. When a website creates IndexedDB databases, Firefox stores the database names using internal UUID mappings. The indexedDB.databases() function returns the list of these databases in a specific order based on how they are stored in a global hash table .

The vulnerability arises because the returned order is not re-randomized and is consistent across different origins. The sequence of database names returned by the API follows the hash table iteration order without sorting or randomization. This order remains stable for the entire lifetime of the browser process, even across different tabs, websites, and browsing sessions .

Key technical behavior:

• In Private Browsing mode, database names are mapped to UUIDs stored in a global hash table shared across multiple origins and persist until the browser is completely closed
• The returned data follows the order of the hash table without re-randomization, creating a stable, deterministic identifier
• This sequence serves as a high-entropy fingerprint consistent across tabs, sites, and sessions
• The identifier persists after closing Private Browsing windows as long as the browser process remains running

Attack Vector

Primary Attack Vector:
Remote / Network (Visiting a malicious or compromised website)

Attack Scenario:

1. An attacker creates a malicious website or injects malicious code into a legitimate site
2. The victim visits the site using a vulnerable version of Firefox, Firefox ESR, Thunderbird (browser context)
3. The malicious site creates a set of IndexedDB databases with specially chosen names
4. The site calls indexedDB.databases() to retrieve the list of database names in their returned order
5. The ordering of the response serves as a stable, process-scoped identifier that is consistent across different origins and sites
6. The site can read this identifier and use it to:
   • Track the same user across multiple websites
   • Correlate activity across different origins
   • Generate a persistent fingerprint for the browser session

Key Characteristics:

• Requires user interaction – Victims must visit a specially crafted website or URL
• No authentication required – Anyone can trigger the exploit by visiting a malicious site
• Exploitable over network via website access
• Attack complexity is low – Easy to implement
• No user interaction beyond browsing – Visiting the site is sufficient
• No exploit publicly available – As of publication, no public exploit code has been released

Conditions Increasing Risk:

• Use of Firefox in Private Browsing mode (provides false sense of privacy)
• Organizations relying on browser privacy features for security
• Users who keep browser processes running for extended periods
• Environments where cross-site tracking is a concern (advertising networks, analytics providers)

Impact

Successful exploitation allows malicious websites to:

• Generate a unique, deterministic, stable identifier for the entire browser process
• Track user activity across different websites without using cookies or shared storage
• Link browsing sessions across origins that should be isolated from one another
• Fingerprint users in Private Browsing mode – breaking the privacy expectation that private sessions leave no trace
• Track users for the entire lifetime of the browser process – even after closing private windows

Privacy Implications:

This vulnerability fundamentally undermines core privacy expectations – websites should not be able to link users across contexts, and private sessions should leave no trace. Instead, Firefox’s IndexedDB exposes a deterministic, process-level identifier that enables cross-origin and same-origin tracking without cookies .

Observed Exploitation & Threat Activity

• Public Disclosure: April 21, 2026
• Patch Availability: Mozilla released patches on April 21, 2026 (Firefox 150, Firefox ESR 140.10, Thunderbird updates)
• Public Exploit Availability: No public exploit is available as of publication
• In-the-Wild Exploitation: No confirmed active exploitation has been reported, but the vulnerability was discovered by security researchers
• CVSS Score:
  • NVD: 6.5 (Medium)
  • Red Hat: 6.1 (Medium)
  • CSH: Medium (CVSS v4.0)

Affected Platforms:

• Linux distributions including Debian, Red Hat Enterprise Linux, SUSE, Oracle Linux
• Windows, macOS, and all platforms running Firefox and Thunderbird

Severity & Metrics

• CVSS v3.1 (NVD): Medium (6.5)
• CVSS v3.1 (Red Hat): Medium (6.1)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (Red Hat) / None (NVD)
• Scope: Unchanged (NVD) / Changed (Red Hat)
• Confidentiality Impact: Low
• Integrity Impact: None / Low
• Availability Impact: None (some sources list Low)

NVD Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:

Red Hat Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Relevant CWE:

• CWE-440 – Expected Behavior Violation (Red Hat)
• CWE-20 – Improper Input Validation
• CWE-200 – Exposure of Sensitive Information to an Unauthorized Actor

Patch & Vendor Status

• Official Patches Available: Yes – released April 21, 2026
• Fixed Versions:
  • Firefox: Version 150
  • Firefox ESR: Version 140.10
  • Thunderbird: Versions 150 and 140.10

Vendor Response:

Linux Distribution Status:

• Red Hat Enterprise Linux: Fixed in Firefox (RHSA-2026:10766, RHSA-2026:10757, RHSA-2026:10767) and Thunderbird (RHSA-2026:13537, RHSA-2026:12285) updates
• Ubuntu: Thunderbird on 22.04 LTS is vulnerable; Firefox on all supported Ubuntu releases is NOT affected as they use the Snap version (which receives updates directly)
• Debian: Security update available via DLA-4549 for thunderbird
• AlmaLinux: Fixed in thunderbird version 140.10.0-1.el10_1.alma.1
• SUSE, Oracle Linux: Patches available through their respective update channels

Mitigation & Remediation

Immediate Actions

For Ubuntu users: Ubuntu’s Firefox is distributed as a Snap package, which receives updates directly from Mozilla. Ubuntu 22.04 LTS has Thunderbird vulnerable, and the Thunderbird Snap is not affected as it’s updated directly .

Short-Term Defensive Measures

If patching is not immediately possible:

• Use alternative browsers for privacy-sensitive browsing until updates can be applied
• Fully restart the browser process regularly to reset the identifier (close all windows and ensure no background processes remain)
• Disable or restrict IndexedDB via browser extensions or configuration (may break some websites)
• Use Private Browsing without assuming full protection – understand that the identifier persists across private windows within the same process

Long-term Defensive Measures

• Enable automatic browser updates to ensure timely receipt of security patches
• Use browser isolation technologies (e.g., sandboxed browsing environments) for untrusted websites
• Implement Content Security Policy (CSP) headers on websites you control to restrict which origins can access IndexedDB
• Educate users about browser fingerprinting and the limitations of private browsing modes
• Consider using browser extensions that block fingerprinting attempts (though effectiveness varies)
• Regularly audit browser security settings and update policies for enterprise deployments

Detection & Monitoring

Recommended Log Sources:

Indicators of Potential Exploitation:

• No direct exploitation detection possible – This vulnerability does not produce logs or errors during exploitation
• No malicious payload required – Standard IndexedDB API calls are used, indistinguishable from legitimate usage
• Inability to detect via traditional means – The attack uses legitimate browser functionality in an unintended way
• Detection relies on identifying vulnerable versions – Version enumeration is the primary detection method

Detection Strategy:

Given the nature of this vulnerability (abuse of intended functionality rather than code execution), detection focuses on identifying vulnerable systems rather than detecting exploitation attempts:

1. Inventory browser versions across your organization
2. Identify systems running:
   • Firefox before version 150
   • Firefox ESR before version 140.10
   • Thunderbird before version 150 or 140.10
3. Monitor for outdated versions using vulnerability scanners (Nessus plugin ID 310350 available)
4. Track compliance with patch policies for browser software

For security researchers: The vulnerability can be demonstrated by creating IndexedDB databases on different origins and comparing the order returned by indexedDB.databases() – consistent ordering indicates the vulnerability exists .

Post-Incident Response

If exploitation is suspected or privacy breach is a concern:

1. Update affected software immediately to the patched versions
2. Fully restart the browser – The identifier persists until the browser process terminates. Close all windows and ensure no background processes remain
3. Clear browsing data including IndexedDB storage (clearing “Site Data” or “Storage” in browser settings)
4. Assume tracking has occurred – There is no way to determine if the identifier was used to track a user. The identifier may have been exposed to any site visited during the vulnerable period
5. For enterprise environments:
   • Audit browser deployment to ensure all systems have received patches
   • Review privacy impact for any sensitive browsing that occurred before patching
   • Consider whether tracking vectors could have compromised investigations or operations requiring privacy
6. Document and report findings to appropriate parties if systematic tracking is discovered

References

• https://vuldb.com/vuln/358470
• https://cvepremium.circl.lu/vuln/fkie_cve-2026-6770
• https://access.redhat.com/security/cve/cve-2026-6770
• https://ubuntu.com/security/CVE-2026-6770
• https://securityaffairs.com/191374/security/firefox-bug-cve-2026-6770-enabled-cross-site-tracking-and-tor-fingerprinting.html
• https://www.securityweek.com/firefox-vulnerability-allows-tor-user-fingerprinting/
• https://www.thaicert.or.th/en/2026/04/29/cve-2026-6770-vulnerability-found-in-firefox-and-tor-browser-risk-of-cross-site-fingerprinting-tracking/
• https://vuldb.com/vuln/358470
• https://security.snyk.io/vuln/SNYK-ALMALINUX10-THUNDERBIRD-16415511
• https://www.cybersecurity-help.cz/vdb/vulns/126674/
• https://cwe.mitre.org/data/definitions/20.html
• https://cwe.mitre.org/data/definitions/200.html
• https://cwe.mitre.org/data/definitions/440.html