CVE-2023-29546 Information disclosure in Firefox for Android

What is CVE-2023-29546?

CVE-2023-29546 is a medium-severity vulnerability in Mozilla Firefox Mobile, published on 19 Jun 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

When recording the screen while in Private Browsing on Firefox for Android the address bar and keyboard were not hidden, potentially leaking sensitive information.

*This bug only affects Firefox for Android. Other operating systems are unaffected.* This vulnerability affects Firefox for Android < 112 and Focus for Android < 112.

Which versions are affected by CVE-2023-29546?

It affects 2 products.

Products include Mozilla Firefox Focus, Mozilla Firefox Mobile.

How do I fix CVE-2023-29546?

Upgrade to a fixed version.

Is CVE-2023-29546 being exploited?

There is no known exploitation of CVE-2023-29546 in the wild and no public exploit code.

Other vulnerabilities in Mozilla Firefox Mobile

• CVE-2024-10474 Security feature bypass in Focus for iOS Critical 9.1
• CVE-2023-29534 Security feature bypass in Firefox for Android Critical 9.1
• CVE-2024-1563 Race condition in Focus for iOS High 8.1
• CVE-2024-0605 Race condition in Focus for iOS High 7.5
• CVE-2023-25743 Security feature bypass in Firefox High 7.5

All Mozilla Firefox Mobile vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rh4w-355m-vr23, UBUNTU-CVE-2023-29546.