Loading vulnerability…
CVE-2026-6770 is an information disclosure and privacy weakness in the Storage: IndexedDB component of Gecko-based browsers, including Firefox, Thunderbird, and Tor Browser. The issue arises from deterministic behavior in the IndexedDB API, specifically the ordering of entries returned by indexedDB.databases(). In private contexts, database names were mapped to UUIDs stored in a global hash table shared across origins for the lifetime of the browser process, and results were returned using unsorted hash-table iteration. This allowed web content to derive a stable, process-scoped identifier from the returned ordering of IndexedDB database metadata. Because the identifier was not origin-scoped, unrelated sites could independently observe the same value and correlate user activity across sites. The flaw undermined privacy protections expected from Firefox Private Browsing and Tor Browser, including session unlinkability after Tor Browser’s New Identity action.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Small 3-file repository containing a browser-based proof of concept for CVE-2026-6770. The only code file, poc.html, is a self-contained HTML/JavaScript page with a button that triggers identify(). That function creates 26 IndexedDB databases named after keyboard letters, enumerates them with indexedDB.databases(), and checks whether the returned names are sorted. If the list is not sorted, the script treats the ordering as a fingerprint source, concatenates the names, computes a SHA-256 digest, and prints both the raw order and resulting fingerprint to the page. The README simply labels the repo as a Firefox/Tor PoC, and the LICENSE is unrelated boilerplate. There are no external network calls, command execution features, persistence mechanisms, or post-exploitation payloads. The exploit capability is browser fingerprinting/tracking of users across a session by abusing IndexedDB enumeration behavior in vulnerable Firefox/Tor Browser versions; it is best classified as a client-side browser privacy/security PoC rather than an RCE-style exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
31 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A medium-severity information disclosure vulnerability in Firefox and Thunderbird IndexedDB that enables cross-site tracking and browser/Tor session fingerprinting by exposing a stable process-lifetime identifier, including in Private Browsing and Tor Browser sessions.
A privacy-impacting vulnerability in the Gecko engine that can enable browser fingerprinting or tracking across sessions using IndexedDB database enumeration behavior, affecting Firefox and Tor Browser.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.