Loading story…
Researchers disclosed CVE-2026-6770, an IndexedDB information disclosure flaw in Firefox, Thunderbird, and Tor Browser that let websites derive a stable browser-process identifier without cookies. The issue came from the deterministic order returned by indexedDB.databases(), where internal UUID mappings and unsorted hash iteration exposed repeatable browser behavior that could be turned into a hidden fingerprint for cross-site tracking.
The privacy impact was especially severe for users relying on anti-tracking features: the identifier could persist in Firefox Private Browsing and survive Tor Browser’s New Identity reset, allowing separate sites to correlate visits that users expected to be unlinkable. Mozilla said the bug was fixed in Firefox 150, ESR 140.10, and related Thunderbird releases, while the Tor Project patched it in Tor Browser 15.0.10 by normalizing database ordering before exposure; no active exploitation was reported, but the flaw undermined core privacy guarantees in both products.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Public reporting disclosed technical details of CVE-2026-6770, explaining how IndexedDB's predictable return order enabled hidden identifiers and cross-site tracking without cookies. Reports noted there was no evidence of active exploitation but emphasized the privacy impact on Firefox, Thunderbird, and Tor Browser users.
Researchers discovered that the order of entries returned by IndexedDB could act as a stable, deterministic identifier, enabling cross-site tracking and fingerprinting in Firefox, private browsing contexts, and Tor Browser. The flaw could persist across Tor Browser's New Identity resets and private sessions.
The Tor Project released Tor Browser 15.0.10 to fix the IndexedDB ordering flaw that allowed persistent browser fingerprinting even after using the New Identity feature. The remediation sorted exposed data to eliminate the ordering-based identifier.
Mozilla patched CVE-2026-6770 on April 21, 2026, addressing the IndexedDB information disclosure issue in Firefox 150, ESR 140.10, and Thunderbird updates. The fix prevented websites from deriving stable identifiers from IndexedDB database ordering behavior.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
boingboing.net
Open sourcescworld.com
Open sourcesecurityaffairs.com
Open sourcefingerprint.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mozilla patched multiple Firefox vulnerabilities, including a privacy flaw that let websites create hidden, stable identifiers without cookies by abusing the order of entries returned by `IndexedDB`. Researchers Dai Nguyen and Martin Bajanik of Fingerprint reported that the issue could persist across sessions and defeat protections expected from Firefox Private Browsing mode and Tor Browser’s **New Identity** feature, allowing sites to correlate activity that users believed was isolated. Mozilla addressed the issue under **Bug 2024220** in **Firefox 150** and **Firefox ESR 140.10.0**, with additional fixes included in **Firefox 150.0.3** and documented in Mozilla security advisories **MFSA-2026-32** and **MFSA-2026-45**. The Tor Project also incorporated the fix in **Tor Browser 15.0.10**, while Germany’s dCERT later published **Advisory 2026-1477** covering multiple Mozilla Firefox vulnerabilities.
Jun 29, 2026
Mozilla patched a high-severity Firefox vulnerability, **CVE-2026-10702**, after researchers showed that visiting a single malicious webpage could trigger arbitrary code execution inside the browser’s sandboxed renderer process. The flaw was traced to the SpiderMonkey JavaScript engine, where JIT optimization involving `Object.keys()`, `length`, and prototype handling could lead to a **use-after-free** condition. Reported affected versions include Firefox stable releases from **147 through 151.0.2**, while **Firefox ESR 140.12** was not listed as affected. Researchers at Nebula Security said the same bug could also be used against **Tor Browser** builds based on vulnerable Firefox versions, allowing compromise from a webpage visit alone. Nebula published exploit material and used the bug as the first stage of an **IonStack** exploit chain, pairing it with **CVE-2026-43499** ("GhostLock"), a Linux kernel futex flaw, to obtain root on a supported **ARM64 Android 17** Google build. Available reporting said there was **no confirmed in-the-wild exploitation** against users at the time of disclosure.
Jul 29, 2026
Mozilla disclosed and patched two high-severity vulnerability groups, **`CVE-2026-5731`** and **`CVE-2026-6786`**, affecting multiple Firefox and Thunderbird release lines. The flaws were described as memory safety bugs with evidence of memory corruption that could potentially be exploited for **arbitrary code execution**. Affected versions included Firefox earlier than **149.0.2** and **150**, Firefox ESR earlier than **115.34.1**, **140.9.1**, and **140.10**, plus corresponding Thunderbird and Thunderbird ESR releases. The fixes were shipped across standard and ESR channels in **Firefox 149.0.2**, **Firefox 150**, **Firefox ESR 115.34.1**, **Firefox ESR 140.9.1**, **Firefox ESR 140.10**, **Thunderbird 149.0.2**, **Thunderbird 150**, and **Thunderbird ESR 140.9.1/140.10**. The CVE records link the issues to memory-corruption weaknesses including **`CWE-119`**, **`CWE-125`**, **`CWE-787`**, and **`CWE-416`**, and assign high-impact CVSS vectors reflecting potential compromise of confidentiality, integrity, and availability if exploited.
Jun 29, 2026