CVE-2023-4583 Browsing Context potentially not cleared when closing Private Window
Attackers may access private browsing data because the browsing context is not properly cleared when closing a private window in Firefox and Thunderbird.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-4583?
CVE-2023-4583 is a high-severity vulnerability in Mozilla Firefox, published on 11 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When checking if the Browsing Context had been discarded in `HttpBaseChannel`, if the load group was not available then it was assumed to have already been discarded which was not always the case for private channels after the private session had ended. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.
Weakness: CWE-754
Which versions are affected by CVE-2023-4583?
It affects 3 products.
Products include Mozilla Firefox, Mozilla Firefox Esr, Mozilla Thunderbird.
How do I fix CVE-2023-4583?
Upgrade to a fixed version.
Is CVE-2023-4583 being exploited?
There is no known exploitation of CVE-2023-4583 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as DEBIAN-CVE-2023-4583, GHSA-wxxp-w379-49qj, UBUNTU-CVE-2023-4583.