CVE-2017-7843

When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this stored data will persist across multiple private browsing mode sessions because it is not cleared when exiting. This vulnerability affects Firefox ESR < 52.5.2 and Firefox < 57.0.1.

• CWE-200

• http://www.securityfocus.com/bid/102039Issue Tracking, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/102112Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039954Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2017:3382Third Party Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1410106Exploit, Issue Tracking, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2017/12/msg00003.htmlThird Party Advisory
• https://www.debian.org/security/2017/dsa-4062Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2017-27/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2017-28/Vendor Advisory
• http://www.securityfocus.com/bid/102039Issue Tracking, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/102112Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039954Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2017:3382Third Party Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1410106Exploit, Issue Tracking, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2017/12/msg00003.htmlThird Party Advisory
• https://www.debian.org/security/2017/dsa-4062Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2017-27/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2017-28/Vendor Advisory

Published

Jun 11, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-7836The "pingsender" executable used by the Firefox Health Repor…
• CVE-2017-7837SVG loaded through "<img>" tags can use "<meta>" tags within…
• CVE-2017-7838Punycode format text will be displayed for entire qualified …
• CVE-2017-7839Control characters prepended before "javascript:" URLs paste…
• CVE-2017-7840JavaScript can be injected into an exported bookmarks file b…
• CVE-2017-7842If a document's Referrer Policy attribute is set to "no-refe…
• CVE-2017-7844A combination of an external SVG image referenced on a page …
• CVE-2017-7845A buffer overflow occurs when drawing and validating element…
• CVE-2017-7846It is possible to execute JavaScript in the parsed RSS feed …
• CVE-2017-7847Crafted CSS in an RSS feed can leak and reveal local path st…
• CVE-2017-7848RSS fields can inject new lines into the created email struc…
• CVE-2017-7849Nessus 6.10.x before 6.10.5 was found to be vulnerable to a …