CVE-2023-4583

Browsing Context potentially not cleared when closing Private Window

High · published September 11, 2023

CVSS v3.1
7.5
EPSS
1%
Percentile
52.0
In the wild
Unconfirmed
What it is

When checking if the Browsing Context had been discarded in `HttpBaseChannel`, if the load group was not available then it was assumed to have already been discarded which was not always the case for private channels after the private session had ended. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00685 · 52.0th percentile
Published
2023-09-11T08:02Z
EPSS history
Timeline
  • 11 SEP 08:02Z
    Browsing Context potentially not cleared when closing Private Window
    cvelistv5