CVE-2026-6770Patch(mozilla / firefox)

A newly disclosed vulnerability in Firefox (CVE-2026-6770) allowed websites to track users across different sites that lasted for the lifetime of the browser process. This vulnerability let any website quietly build a stable tracking identifier that lasted for the whole lifetime of your Firefox process. It didn’t steal data or abuse storage, it simply read the predictable order in which the IndexedDB API returned database metadata and that order never changed as long as the browser stayed open, so sites could link your activity across tabs, windows, and even after you cleared data or hit the Tor reset button. After the issue was reported Mozilla rolled out the fix in Firefox 150 and ESR 140.10 on April 21 (Tor Browser got the same update). The patch randomizes that metadata order so the trick no longer works.

🚨 Firefox & Tor privacy broken by new bug CVE-2026-6770 allowed websites to track users across sites — even in: • Private Browsing • Tor Browser • “New Identity” sessions No clicks needed. Just visit a site. ⚠ Root issue: IndexedDB leaked a stable fingerprint tied to the browser process Impact: • Cross-site tracking • Tor anonymity weakened ✅ Fixed in: Firefox 150 / Tor 15.0.10 Update immediately. https://securityaffairs.com/191374/security/firefox-bug-cve-2026-6770-enabled-cross-site-tracking-and-tor-fingerprinting.html

OH NONONONONONONO >The vulnerability is tracked as CVE-2026-6770 and has been patched This vulnerability allowed Tor operated via Firefox to be tracked through the Onion network. https://t.co/efHdatapDe

ثغرة CVE-2026-6770 في فايرفوكس وتور سمحت بتتبع المستخدمين عبر المواقع حتى في التصفح الخاص بسبب خلل في IndexedDB. موزيلا أغلقت الثغرة في تحديث فايرفوكس 150 وتور أصدر 15.0.10. لا دلائل على استغلال نشط، لكن الخطر كان في تجاوز آليات العزل وكشف هوية الجلسات. #تقنية #الامن_السيبراني https://t.co/4tvlSs2XL9

Evet, ilginç bir privacy sorunu. CVE-2026-6770, Firefox’un IndexedDB bileşenindeki bir açık sayesinde private browsing ve Tor Browser’da bile siteler arası fingerprinting yapılmasına izin veriyordu (indexedDB.databases() üzerinden stabil bir tanımlayıcı sızdırıyordu). Mozilla 21 Nisan 2026’da Firefox 150, ESR 140.10 ve Tor Browser 15.0.10 ile yamadı. Detaylı advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2026-30/ Hemen güncelle!

📌تعرض فايرفوكس لثغرة أمنية في ميزة IndexedDB، والتي يمكن استغلالها لتتبع المستخدمين عبر المواقع الإلكترونية وتحديد هويتهم على شبكة تور. وقد أغلقت موزيلا هذه الثغرة الأمنية، التي تم تعريفها كـ CVE-2026-6770. يُنصح المستخدمون بتحديث المتصفح إلى أحدث إصدار للحماية من هذه الثغرة. 🔗 للمزيد: https://www.security.nl/posting/934354/Firefox-bug+maakt+cross-site+tracking+en+Tor-fingerprinting+mogelijk?channel=rss

Need to bypass internet censorship? Liberty336 has re-opened our hidden tor services and made a new tor bridge! For security reasons, use tor browser 15.0.10 or up to avoid CVE-2026-6770! If you ever forget our .onion or public tor bridge information, it's literally at the bottom of the homepage of our website. (Private bridges are distributed via Tor Project BridgeDB + friends) There's also a "copy" button that will copy the public bridge code into your clipboard, simply paste into your tor web browser search panel and boom, it works! We also enabled regular access and tor access to our IRC network. Simply go to: liberty336 .com/irc #main is the main channel. If you're a client who wants to leave a message on IRC without staying online for a long period of time, simply use memoserv to send a memo to whoever is helping you. If you're an IRC enthusiast who likes to join niche networks and support Open Source, Liberty, etc, you're welcome to come join and idle. These services will be very helpful to those who have need for them. (Especially the bridge) Back to backend work, but will have more updates for you in the future.

Исследователи обнаружили уязвимость в Firefox, из-за которой сайты могли отслеживать пользователей даже в режиме приватного просмотра. Проблема, получившая идентификатор CVE-2026-6770, также затронула Tor Browser, поскольку он основан на Firefox. https://www.anti-malware.ru/news/2026-04-27-111332/49844

Firefox bug CVE-2026-6770 enabled cross-site tracking and Tor fingerprinting https://securityaffairs.com/191374/security/firefox-bug-cve-2026-6770-enabled-cross-site-tracking-and-tor-fingerprinting.html

Firefox bug CVE-2026-6770 enabled cross-site tracking and Tor fingerprinting - https://securityaffairs.com/191374/security/firefox-bug-cve-2026-6770-enabled-cross-site-tracking-and-tor-fingerprinting.html

🛑A new Firefox flaw, CVE-2026-6770, let websites track users during the full browser session. Any site could create a stable identifier without permission or visible signs. The bug used the predictable order of IndexedDB metadata returned by Firefox. That order stayed the same until the browser process was fully closed. Because of this, sites could link activity across tabs and windows. Tracking could continue even after clearing data or using the Tor reset button. The flaw did not steal files, passwords, or stored data. It only abused metadata order to recognize the same browser session. Mozilla fixed the issue on April 21. The patch arrived in Firefox 150 and ESR 140.10, with Tor Browser updated too. Firefox now randomizes the metadata order. This stops websites from using the trick again.

A Firefox flaw could have let attackers fingerprint Tor users, putting privacy at risk. Update your browsers now to stay protected against threats like CVE-2026-6770. 🛡️ #cybersecurity #privacy Source: Security Week https://t.co/zRaXZ8psEv

#Firefox bug CVE-2026-6770 enabled cross-site tracking and #Tor fingerprinting https://securityaffairs.com/191374/security/firefox-bug-cve-2026-6770-enabled-cross-site-tracking-and-tor-fingerprinting.html #securityaffairs #hacking

Tor Browser routes your traffic through the Tor anonymity network and separates sessions. "New Identity" is the reset button: new Tor circuits, cleared cookies, cleared storage. CVE-2026-6770 (Mozilla Bug 2024220) was fixed in Firefox 150, released April 21, 2026.

The vulnerability, tracked as CVE-2026-6770, is related to the IndexedDB browser API, which is used for storing structured data on the client side. https://t.co/KBjcHXW5Hl

CVE-2026-6770 in #Firefox allowed cross-site fingerprinting in Private Browsing, enabling unrelated domains to detect a shared unique identifier and link user activity. Patched April 21, 2026 in Firefox 150, ESR 140.10, and Thunderbird. https://t.co/XAf3hwBpN9

New on 0dayinc: CVE-2026-6770 and the Firefox IndexedDB Cross-Origin Correlation Leak. Our whitepaper breaks down how indexedDB.databases() became a process-lifetime correlation signal in Firefox/Tor, plus fix versions and safe lab validation. https://www.0dayinc.com/post/whitepaper-cve-2026-6770-and-the-firefox-indexeddb-cross-origin-correlation-leak

#Firefox #vulnerabilities #bug CVE-2026-6770 enabled #cross_site_tracking and #Tor_fingerprinting https://ift.tt/1wHKYF6 https://t.co/g6KT7L2C66

BREAKING: CVE-2026-6770 lets attackers fingerprint Firefox and Tor users across sessions via IndexedDB, patched in Firefox 150 and Tor Browser 15.0.10 on April 21, 2026. https://threatcluster.io/cluster/firefox-bug-cve-2026-6770-allows-tracking-of-tor-users-628a0545

InfoSec News Nuggets 04/27/2026 https://ift.tt/6UxosAJ Firefox Vulnerability Allows Tor User Fingerprinting Researchers disclosed CVE-2026-6770, an IndexedDB issue that can let sites correlate a user’s activity across domains, including in Firefox Private Browsing and Tor Br…