{"id":169865,"date":"2026-04-23T18:24:28","date_gmt":"2026-04-23T16:24:28","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-api-indexeddb-pozvolyayushhaya-identificzirovat-polzovatelej-firefox-i-tor-browser"},"modified":"2026-04-23T18:24:28","modified_gmt":"2026-04-23T16:24:28","slug":"uyazvimost-v-api-indexeddb-pozvolyayushhaya-identificzirovat-polzovatelej-firefox-i-tor-browser","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-api-indexeddb-pozvolyayushhaya-identificzirovat-polzovatelej-firefox-i-tor-browser","title":{"rendered":"Zranitelnost v API IndexedDB, kter\u00e1 umo\u017e\u0148uje identifikaci u\u017eivatel\u016f Firefoxu a Tor Browseru","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V prohl\u00ed\u017ee\u010di zalo\u017een\u00e9m na enginu Gecko byla objevena zranitelnost (CVE-2026-6770), kter\u00e1 umo\u017e\u0148uje vytv\u00e1\u0159et jedine\u010dn\u00e9 identifik\u00e1tory pro sledov\u00e1n\u00ed otev\u0159en\u00ed r\u016fzn\u00fdch webov\u00fdch str\u00e1nek z jednoho prohl\u00ed\u017ee\u010de. Probl\u00e9m se vyskytuje ve v\u0161ech prohl\u00ed\u017ee\u010d\u00edch zalo\u017een\u00fdch na Firefoxu, v\u010detn\u011b Tor Browseru, a funguje dokonce i v re\u017eimu soukrom\u00e9ho prohl\u00ed\u017een\u00ed. Identifik\u00e1tory plat\u00ed v r\u00e1mci aktu\u00e1ln\u00edho procesu prohl\u00ed\u017ee\u010de a jsou vymaz\u00e1ny po restartu prohl\u00ed\u017ee\u010de. Zranitelnost byla opravena ve verz\u00edch Firefoxu 150\/140.10.0 a Tor Browseru 15.0.10. <\/p>\n

Pro vytvo\u0159en\u00ed identifik\u00e1toru sta\u010d\u00ed na r\u016fzn\u00fdch webech vytvo\u0159it stejnou sekvenci DB prost\u0159ednictv\u00edm API IndexedDB, pot\u00e9 vyhodnotit po\u0159ad\u00ed t\u011bchto DB p\u0159i vol\u00e1n\u00ed metody indexedDB.databases(). Pro r\u016fzn\u00e9 instance prohl\u00ed\u017ee\u010de se po\u0159ad\u00ed uveden\u00ed DB bude li\u0161it, ale pro jednu se bude opakovat. Toto po\u0159ad\u00ed se uchov\u00e1v\u00e1 do restartov\u00e1n\u00ed prohl\u00ed\u017ee\u010de a reprodukuje se nez\u00e1visle na nav\u0161t\u011bvovan\u00e9 str\u00e1nce. <\/p>\n

Nap\u0159\u00edklad po vytvo\u0159en\u00ed DB \u201aa,b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,r\u2018 v jedn\u00e9 instanci Firefox metoda indexedDB.databases() v\u017edy vr\u00e1t\u00ed \u201ag,c,p,a,l,f,n,r,d,j,b,o,h,e,m,i,k\u2018, zat\u00edmco v jin\u00e9 instanci - \u201aj,b,o,h,e,m,i,k,f,n,r,d,g,c,p,a,l\u2018. P\u0159i vytvo\u0159en\u00ed 16 DB lze z\u00edskat p\u0159ibli\u017en\u011b 44 bit\u016f entropie pro identifikaci. Na generaci identifik\u00e1toru nem\u00e1 vliv vymaz\u00e1n\u00ed lok\u00e1ln\u00edch prohl\u00ed\u017eec\u00edch \u00falo\u017ei\u0161\u0165 a obnoven\u00ed \u0159et\u011bzce uzl\u016f Tor tla\u010d\u00edtkem \u201aNov\u00e1 identita\u2018 v Tor Browseru. Metoda m\u016f\u017ee b\u00fdt tak\u00e9 pou\u017eita k identifikaci u\u017eivatel\u016f v okn\u011b soukrom\u00e9ho prohl\u00ed\u017een\u00ed. <\/p>\n

Zranitelnost je zp\u016fsobena zvl\u00e1\u0161tnost\u00ed implementace API IndexedDB, na kter\u00e9 po\u0159ad\u00ed datab\u00e1z\u00ed z\u00e1vis\u00ed od uspo\u0159\u00e1d\u00e1n\u00ed vnit\u0159n\u00edch struktur specifick\u00fdch pro ka\u017edou instanci pracovn\u00edho procesu prohl\u00ed\u017ee\u010de. Po\u0159ad\u00ed prvk\u016f v seznamu datab\u00e1z\u00ed, kter\u00fd vrac\u00ed metoda indexedDB.databases(), nez\u00e1vis\u00ed na n\u00e1zvech datab\u00e1z\u00ed nebo po\u0159ad\u00ed jejich vytvo\u0159en\u00ed, ale na um\u00edst\u011bn\u00ed v glob\u00e1ln\u00ed hash tabulce vnit\u0159n\u00edch UUID hash\u016f asociovan\u00fdch s n\u00e1zvy soubor\u016f, ve kter\u00fdch jsou datab\u00e1ze ulo\u017een\u00e9 na disku.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043d\u043e\u043c \u0434\u0432\u0438\u0436\u043a\u0435 Gecko \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-6770), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b\u0435 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u043b\u044f \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u044f \u0438\u0437 \u043e\u0434\u043d\u043e\u0433\u043e \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430 \u0440\u0430\u0437\u043d\u044b\u0445 \u0441\u0430\u0439\u0442\u043e\u0432. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432\u043e \u0432\u0441\u0435\u0445 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u0445 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 Firefox, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Tor Browser, \u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0434\u0430\u0436\u0435 \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0441\u043c\u043e\u0442\u0440\u0430. \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0442 \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u0442\u0435\u043a\u0443\u0449\u0435\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430 \u0438 \u0441\u0431\u0440\u0430\u0441\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u043f\u043e\u0441\u043b\u0435 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 Firefox 150\/140.10.0 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-169865","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranitelnost v API IndexedDB, kter\u00e1 umo\u017e\u0148uje identifikaci u\u017eivatel\u016f Firefoxu a Tor Browseru | ProHoster","description":"V prohl\u00ed\u017ee\u010di zalo\u017een\u00e9m na enginu Gecko byla objevena zranitelnost (CVE-2026-6770), kter\u00e1 umo\u017e\u0148uje vytv\u00e1\u0159et jedine\u010dn\u00e9 identifik\u00e1tory pro sledov\u00e1n\u00ed otev\u0159en\u00ed r\u016fzn\u00fdch webov\u00fdch str\u00e1nek z jednoho prohl\u00ed\u017ee\u010de.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-api-indexeddb-pozvolyayushhaya-identificzirovat-polzovatelej-firefox-i-tor-browser","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 API IndexedDB, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 Firefox \u0438 Tor Browser | ProHoster","og:description":"\u0412 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043d\u043e\u043c \u0434\u0432\u0438\u0436\u043a\u0435 Gecko \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-6770), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b\u0435 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u043b\u044f \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u044f \u0438\u0437 \u043e\u0434\u043d\u043e\u0433\u043e \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430 \u0440\u0430\u0437\u043d\u044b\u0445 \u0441\u0430\u0439\u0442\u043e\u0432.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-api-indexeddb-pozvolyayushhaya-identificzirovat-polzovatelej-firefox-i-tor-browser","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-04-23T16:24:28+00:00","article:modified_time":"2026-04-23T16:24:28+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/169865","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=169865"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/169865\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=169865"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=169865"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=169865"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}