Information Disclosure in Firefox Networking Cache

Executive Summary

This is an information disclosure vulnerability in Firefox's Networking Cache component. It was patched in Firefox version 158. The issue allows unauthorized access to sensitive cached data that should remain private.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves Firefox's Shared Compression Dictionary cache exposing cross-site tracking via the Available-Dictionary HTTP header. To detect it, monitor HTTP responses for the Available-Dictionary header in network traffic. Check if the header reveals cache keys that include only the origin prepath without OriginAttributes, indicating improper partitioning.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this flaw could let attackers view sensitive information stored in the browser's cache, such as login credentials, personal data, or browsing history without proper authorization.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability enables cross-site tracking via the Available-Dictionary HTTP header, which could lead to unauthorized collection of user data across different sites. This may violate privacy principles under GDPR and HIPAA by exposing user browsing history without consent.

Useful 0 Not Useful 0

Mitigation Strategies

Update Firefox to version 158 or later to address the information disclosure vulnerability in the Networking: Cache component.

Useful 0 Not Useful 0