CVE-2017-7843
When Private Browsing mode is used, it is possible for a web worker to write persistent data to...
When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this stored data will persist across multiple private browsing mode sessions because it is not cleared when exiting. This vulnerability affects Firefox ESR < 52.5.2 and Firefox < 57.0.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this stored data will persist across multiple private browsing mode sessions because it is not cleared when exiting. This vulnerability affects Firefox ESR < 52.5.2 and Firefox < 57.0.1.
- Record
CVE-2017-7843- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this stored data will persist across multiple private browsing mode sessions because it is not cleared when exiting. This vulnerability affects Firefox ESR < 52.5.2 and Firefox < 57.0.1.
- Record
CVE-2017-7843- Updated
- 2026-11-02
EUVDEUVD-2017-16818 No score
When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this stored data will persist across multiple private browsing mode sessions because it is not cleared when exiting. This vulnerability affects Firefox ESR < 52.5.2 and Firefox < 57.0.1.
- Record
EUVD-2017-16818- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rpf5-xpfp-546f
When Private Browsing mode is used, it is possible for a web worker to write persistent data to...
When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this stored data will persist across multiple private browsing mode sessions because it is not cleared when exiting. This vulnerability affects Firefox ESR < 52.5.2 and Firefox < 57.0.1.
- Record
GHSA-rpf5-xpfp-546f- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this stored data will persist across multiple private browsing mode sessions because it is not cleared when exiting. This vulnerability affects Firefox ESR < 52.5.2 and Firefox < 57.0.1.
- Record
CVE-2017-7843- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-7843
When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this stored data will persist across multiple private browsing mode sessions because it is not cleared when exiting. This vulnerability affects Firefox ESR < 52.5.2 and Firefox < 57.0.1.
- Record
DEBIAN-CVE-2017-7843- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 6 moreShow less
OSVRHSA-2017:3382
Red Hat Security Advisory: firefox security update
- Record
RHSA-2017:3382- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-7843
When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this stored data will persist across multiple private browsing mode sessions because it is not cleared when exiting. This vulnerability affects Firefox ESR < 52.5.2 and Firefox < 57.0.1.
- Record
UBUNTU-CVE-2017-7843- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVMGASA-2017-0448 No score
Updated firefox packages fix security vulnerability
Web worker in Private Browsing mode can write IndexedDB data. (CVE-2017-7843)
- Record
MGASA-2017-0448- Updated
- 2026-11-02
OSVMGASA-2018-0018 No score
Updated iceape packages fix security vulnerabilities
Updated iceape packages include security fixes from upstream Seamonkey and Firefox:
Multiple flaws were found in the way Iceape 2.48 processes various types of web content, where loading a web page containing malicious content could cause Iceape to crash, execute arbitrary code, or disclose sensitive information. (CVE-2016-10196,CVE-2017-5398,CVE-2017-5399, CVE-2017-5400,CVE-2017-5401,CVE-2017-5402,CVE-2017-5403,CVE-2017-5404, CVE-2017-5405,CVE-2017-5406,CVE-2017-5407,CVE-2017-5409,CVE-2017-5410, CVE-2017-5411,CVE-2017-5408,CVE-2017-5412,CVE-2017-5413,CVE-2017-5414, CVE-2017-5415,CVE-2017-5416,CVE-2017-5417,CVE-2017-5425,CVE-2017-5426, CVE-2017-5427,CVE-2017-5418,CVE-2017-5419,CVE-2017-5420,CVE-2017-5421, CVE-2017-5422,CVE-2017-5429,CVE-2017-5430,CVE-2017-5432,CVE-2017-5433, CVE-2017-5434,CVE-2017-5435,CVE-2017-5436,CVE-2017-5438,CVE-2017-5439, CVE-2017-5440,CVE-2017-5441,CVE-2017-5442,CVE-2017-5443,CVE-2017-5444, CVE-2017-5445,CVE-2017-5446,CVE-2017-5447,CVE-2017-5448,CVE-2017-5449, CVE-2017-5451,CVE-2017-5454,CVE-2017-5455,CVE-2017-5456,CVE-2017-5459, CVE-2017-5460,CVE-2017-5461,CVE-2017-5462,CVE-2017-5464,CVE-2017-5465, CVE-2017-5466,CVE-2017-5467,CVE-2017-5469,CVE-2017-5470,CVE-2017-5472, CVE-2017-7749,CVE-2017-7750,CVE-2017-7751,CVE-2017-7752,CVE-2017-7753, CVE-2017-7754,CVE-2017-7755,CVE-2017-7756,CVE-2017-7757,CVE-2017-7758, CVE-2017-7760,CVE-2017-7761,CVE-2017-7763,CVE-2017-7764,CVE-2017-7765, CVE-2017-7766,CVE-2017-7767,CVE-2017-7768,CVE-2017-7778,CVE-2017-7779, CVE-2017-7782,CVE-2017-7784,CVE-2017-7785,CVE-2017-7786,CVE-2017-7787, CVE-2017-7791,CVE-2017-7792,CVE-2017-7793,CVE-2017-7798,CVE-2017-7800, CVE-2017-7801,CVE-2017-7802,CVE-2017-7803,CVE-2017-7804,CVE-2017-7805, CVE-2017-7807,CVE-2017-7809,CVE-2017-7810,CVE-2017-7814,CVE-2017-7818, CVE-2017-7819,CVE-2017-7823,CVE-2017-7824,CVE-2017-7825,CVE-2017-7826, CVE-2017-7828,CVE-2017-7830,CVE-2017-7843,CVE-2017-7845)
- Record
MGASA-2018-0018- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10600-1 No score
MozillaFirefox-92.0-1.2 on GA media
These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10600-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score
firefox-esr-128.5.1-1.1 on GA media
These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14572-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
firefox-esrDebian:12 |
before 52.5.2esr-1 | 52.5.2esr-1 |
firefox-esrDebian:13 |
before 52.5.2esr-1 | 52.5.2esr-1 |
firefox-esrDebian:14 |
before 52.5.2esr-1 | 52.5.2esr-1 |
firefox-esrDebian:7 |
before 52.5.2esr-1~deb7u1, plus listed versions 45.0.1esr-145.0.2esr-145.0esr-145.0esr-245.1.0esr-1 Show 45 moreShow less45.1.1esr-145.2.0esr-145.2.0esr-1~deb7u145.2.0esr-1~deb8u145.3.0esr-145.3.0esr-1~deb7u145.3.0esr-1~deb8u145.3.0esr-245.4.0esr-145.4.0esr-1~deb7u145.4.0esr-1~deb7u245.4.0esr-1~deb8u145.4.0esr-1~deb8u245.4.0esr-245.5.0esr-145.5.0esr-1~deb8u145.5.1esr-145.5.1esr-1~deb7u145.5.1esr-1~deb8u145.6.0esr-145.6.0esr-1~deb7u145.6.0esr-1~deb8u145.7.0esr-145.7.0esr-1~deb7u145.7.0esr-1~deb8u145.7.0esr-245.7.0esr-345.7.0esr-445.8.0esr-145.8.0esr-1~deb7u145.8.0esr-1~deb8u145.9.0esr-145.9.0esr-1~deb7u145.9.0esr-1~deb8u152.0.1esr-152.0.2esr-152.0esr-152.1.0esr-152.2.0esr-152.2.0esr-1~deb7u152.2.0esr-1~deb8u152.2.0esr-1~deb9u152.2.0esr-252.3.0esr-152.3.0esr-1~deb7u1 |
52.5.2esr-1~deb7u1 |
firefox-esrDebian:8 |
before 52.5.2esr-1~deb8u1, plus listed versions 45.0.1esr-145.0.2esr-145.0esr-145.0esr-245.1.0esr-1 Show 45 moreShow less45.1.1esr-145.2.0esr-145.2.0esr-1~deb7u145.2.0esr-1~deb8u145.3.0esr-145.3.0esr-1~deb7u145.3.0esr-1~deb8u145.3.0esr-245.4.0esr-145.4.0esr-1~deb7u145.4.0esr-1~deb7u245.4.0esr-1~deb8u145.4.0esr-1~deb8u245.4.0esr-245.5.0esr-145.5.0esr-1~deb8u145.5.1esr-145.5.1esr-1~deb7u145.5.1esr-1~deb8u145.6.0esr-145.6.0esr-1~deb7u145.6.0esr-1~deb8u145.7.0esr-145.7.0esr-1~deb7u145.7.0esr-1~deb8u145.7.0esr-245.7.0esr-345.7.0esr-445.8.0esr-145.8.0esr-1~deb7u145.8.0esr-1~deb8u145.9.0esr-145.9.0esr-1~deb7u145.9.0esr-1~deb8u152.0.1esr-152.0.2esr-152.0esr-152.1.0esr-152.2.0esr-152.2.0esr-1~deb7u152.2.0esr-1~deb8u152.2.0esr-1~deb9u152.2.0esr-252.3.0esr-152.3.0esr-1~deb7u1 |
52.5.2esr-1~deb8u1 |
firefox-esrDebian:9 |
before 52.5.2esr-1~deb9u1, plus listed versions 45.9.0esr-152.0.1esr-152.0.2esr-152.0esr-152.1.0esr-1 Show 21 moreShow less52.2.0esr-152.2.0esr-1~deb7u152.2.0esr-1~deb8u152.2.0esr-1~deb9u152.2.0esr-252.3.0esr-152.3.0esr-1~deb7u152.3.0esr-1~deb8u152.3.0esr-1~deb8u252.3.0esr-1~deb9u152.3.0esr-252.4.0esr-1~deb8u152.4.0esr-1~deb9u152.4.0esr-252.4.0esr-2~deb7u152.5.0esr-152.5.0esr-1~deb7u152.5.0esr-1~deb8u152.5.0esr-1~deb9u152.5.2esr-1~deb7u152.5.2esr-1~deb8u1 |
52.5.2esr-1~deb9u1 |
firefoxMageia:5 |
before 52.5.2-1.mga5 | 52.5.2-1.mga5 |
firefox-l10nMageia:5 |
before 52.5.2-1.mga5 | 52.5.2-1.mga5 |
firefoxMageia:6 |
before 52.5.2-1.mga6 | 52.5.2-1.mga6 |
firefox-l10nMageia:6 |
before 52.5.2-1.mga6 | 52.5.2-1.mga6 |
Show 21 moreShow less
| Package | Affected | Fixed |
|---|---|---|
iceapeMageia:5 From an advisory covering 112 CVEs |
before 2.49.1-3.mga5 | 2.49.1-3.mga5 |
iceapeMageia:6 From an advisory covering 112 CVEs |
before 2.49.1-3.mga6 | 2.49.1-3.mga6 |
firefoxRed Hat:enterprise_linux:6::client |
before 0:52.5.1-1.el6_9 | 0:52.5.1-1.el6_9 |
firefox-debuginfoRed Hat:enterprise_linux:6::client |
before 0:52.5.1-1.el6_9 | 0:52.5.1-1.el6_9 |
firefoxRed Hat:enterprise_linux:6::computenode |
before 0:52.5.1-1.el6_9 | 0:52.5.1-1.el6_9 |
firefox-debuginfoRed Hat:enterprise_linux:6::computenode |
before 0:52.5.1-1.el6_9 | 0:52.5.1-1.el6_9 |
firefoxRed Hat:enterprise_linux:6::server |
before 0:52.5.1-1.el6_9 | 0:52.5.1-1.el6_9 |
firefox-debuginfoRed Hat:enterprise_linux:6::server |
before 0:52.5.1-1.el6_9 | 0:52.5.1-1.el6_9 |
firefoxRed Hat:enterprise_linux:6::workstation |
before 0:52.5.1-1.el6_9 | 0:52.5.1-1.el6_9 |
firefox-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:52.5.1-1.el6_9 | 0:52.5.1-1.el6_9 |
firefoxRed Hat:enterprise_linux:7::client |
before 0:52.5.1-1.el7_4 | 0:52.5.1-1.el7_4 |
firefox-debuginfoRed Hat:enterprise_linux:7::client |
before 0:52.5.1-1.el7_4 | 0:52.5.1-1.el7_4 |
firefoxRed Hat:enterprise_linux:7::server |
before 0:52.5.1-1.el7_4 | 0:52.5.1-1.el7_4 |
firefox-debuginfoRed Hat:enterprise_linux:7::server |
before 0:52.5.1-1.el7_4 | 0:52.5.1-1.el7_4 |
firefoxRed Hat:enterprise_linux:7::workstation |
before 0:52.5.1-1.el7_4 | 0:52.5.1-1.el7_4 |
firefox-debuginfoRed Hat:enterprise_linux:7::workstation |
before 0:52.5.1-1.el7_4 | 0:52.5.1-1.el7_4 |
firefoxUbuntu:14.04:LTS |
before 57.0.1+build2-0ubuntu0.14.04.1, plus listed versions 24.0+build1-0ubuntu125.0+build3-0ubuntu0.13.10.128.0~b2+build1-0ubuntu228.0+build1-0ubuntu128.0+build2-0ubuntu1 Show 45 moreShow less28.0+build2-0ubuntu229.0+build1-0ubuntu0.14.04.230.0+build1-0ubuntu0.14.04.331.0+build1-0ubuntu0.14.04.132.0+build1-0ubuntu0.14.04.132.0.3+build1-0ubuntu0.14.04.133.0+build2-0ubuntu0.14.04.134.0+build2-0ubuntu0.14.04.135.0+build3-0ubuntu0.14.04.235.0.1+build1-0ubuntu0.14.04.136.0+build2-0ubuntu0.14.04.436.0.1+build2-0ubuntu0.14.04.136.0.4+build1-0ubuntu0.14.04.137.0+build2-0ubuntu0.14.04.137.0.1+build1-0ubuntu0.14.04.137.0.2+build1-0ubuntu0.14.04.138.0+build3-0ubuntu0.14.04.139.0+build5-0ubuntu0.14.04.139.0.3+build2-0ubuntu0.14.04.140.0+build4-0ubuntu0.14.04.140.0+build4-0ubuntu0.14.04.440.0.3+build1-0ubuntu0.14.04.141.0+build3-0ubuntu0.14.04.141.0.1+build2-0ubuntu0.14.04.141.0.2+build2-0ubuntu0.14.04.142.0+build2-0ubuntu0.14.04.143.0+build1-0ubuntu0.14.04.143.0.4+build3-0ubuntu0.14.04.144.0+build3-0ubuntu0.14.04.144.0.1+build2-0ubuntu0.14.04.144.0.2+build1-0ubuntu0.14.04.145.0+build2-0ubuntu0.14.04.145.0.1+build1-0ubuntu0.14.04.245.0.2+build1-0ubuntu0.14.04.146.0+build5-0ubuntu0.14.04.246.0.1+build1-0ubuntu0.14.04.347.0+build3-0ubuntu0.14.04.148.0+build2-0ubuntu0.14.04.149.0+build4-0ubuntu0.14.04.149.0.2+build2-0ubuntu0.14.04.150.0+build2-0ubuntu0.14.04.250.0.2+build1-0ubuntu0.14.04.150.1.0+build2-0ubuntu0.14.04.151.0.1+build2-0ubuntu0.14.04.151.0.1+build2-0ubuntu0.14.04.2 |
57.0.1+build2-0ubuntu0.14.04.1 |
firefoxUbuntu:16.04:LTS |
before 57.0.1+build2-0ubuntu0.16.04.1, plus listed versions 41.0.2+build2-0ubuntu142.0+build2-0ubuntu144.0+build3-0ubuntu244.0.1+build1-0ubuntu144.0.2+build1-0ubuntu1 Show 27 moreShow less45.0+build2-0ubuntu145.0.1+build1-0ubuntu145.0.2+build1-0ubuntu146.0+build5-0ubuntu0.16.04.246.0.1+build1-0ubuntu0.16.04.247.0+build3-0ubuntu0.16.04.148.0+build2-0ubuntu0.16.04.149.0+build4-0ubuntu0.16.04.149.0.2+build2-0ubuntu0.16.04.250.0+build2-0ubuntu0.16.04.250.0.2+build1-0ubuntu0.16.04.150.1.0+build2-0ubuntu0.16.04.151.0.1+build2-0ubuntu0.16.04.151.0.1+build2-0ubuntu0.16.04.252.0+build2-0ubuntu0.16.04.152.0.1+build2-0ubuntu0.16.04.152.0.2+build1-0ubuntu0.16.04.153.0+build6-0ubuntu0.16.04.153.0.2+build1-0ubuntu0.16.04.253.0.3+build1-0ubuntu0.16.04.254.0+build3-0ubuntu0.16.04.155.0.1+build2-0ubuntu0.16.04.255.0.2+build1-0ubuntu0.16.04.156.0+build6-0ubuntu0.16.04.156.0+build6-0ubuntu0.16.04.257.0+build4-0ubuntu0.16.04.557.0+build4-0ubuntu0.16.04.6 |
57.0.1+build2-0ubuntu0.16.04.1 |
firefoxUbuntu:18.04:LTS |
before 57.0.1+build2-0ubuntu1, plus listed versions 56.0+build6-0ubuntu1 |
57.0.1+build2-0ubuntu1 |
MozillaFirefoxopenSUSE:Tumbleweed From an advisory covering 661 CVEs |
before 92.0-1.2 | 92.0-1.2 |
firefox-esropenSUSE:Tumbleweed From an advisory covering 1860 CVEs |
before 128.5.1-1.1 | 128.5.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-7843 is a high vulnerability (CVSS 7.5) in Mozilla Firefox, published December 10, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.89%, the 86th percentile. Fixed in firefox-esr 52.5.2esr-1.
References
access.redhat.com/errata/RHSA-2017:3382
lists.debian.org/debian-lts-announce/2017/12/msg00003.html
mozilla.org/security/advisories/mfsa2017-28
securitytracker.com/id/1039954
debian.org/security/2017/dsa-4062
Show 194 moreShow less
bugzilla.mozilla.org/show_bug.cgi?id=1410106
securityfocus.com/bid/102039
nvd.nist.gov/vuln/detail/CVE-2017-7843
github.com/advisories/GHSA-rpf5-xpfp-546f
security-tracker.debian.org/tracker/CVE-2017-7843
advisories.mageia.org/MGASA-2017-0448.html
bugs.mageia.org/show_bug.cgi?id=22129
bugzilla.redhat.com/show_bug.cgi?id=1518566
security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_3382.json
cve.org/CVERecord?id=CVE-2017-7843
ubuntu.com/security/CVE-2017-7843
suse.com/security/cve/CVE-2006-6077
lists.opensuse.org/archives/list/[email protected]/thread/3HI2RC7AJAHY74Q6MK7GNGWU6TITB22V
Left out here: 38 versions and 1,691 references. The JSON record has them.