{"id":169865,"date":"2026-04-23T18:24:28","date_gmt":"2026-04-23T16:24:28","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-api-indexeddb-pozvolyayushhaya-identificzirovat-polzovatelej-firefox-i-tor-browser"},"modified":"2026-04-23T18:24:28","modified_gmt":"2026-04-23T16:24:28","slug":"uyazvimost-v-api-indexeddb-pozvolyayushhaya-identificzirovat-polzovatelej-firefox-i-tor-browser","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-api-indexeddb-pozvolyayushhaya-identificzirovat-polzovatelej-firefox-i-tor-browser","title":{"rendered":"S\u00e5rbarhed i API'en IndexedDB, der muligg\u00f8r identifikation af brugere af Firefox og Tor Browser.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Der browsermotor Gecko har identificeret en s\u00e5rbarhed (CVE-2026-6770), der muligg\u00f8r oprettelse af unikke identifikatorer til at spore \u00e5bningen af forskellige sider fra \u00e9n browser. Problemet optr\u00e6der i alle Firefox-baserede browsere, herunder Tor Browser, og fungerer selv i privat browsing. Identifikatorerne g\u00e6lder inden for den aktuelle browserproces og nulstilles efter genstart af browseren. S\u00e5rbarheden er blevet udbedret i versionerne Firefox 150\/140.10.0 og Tor Browser 15.0.10. <\/p>\n
For forming an identifier, it is sufficient to create the same sequence of databases through the API IndexedD on different sites, after which the order of these databases can be evaluated as a result of calling the method indexedDB.databases(). For different instances of browsers, the order of enumerating databases will differ, but for one instance \u2014 it will repeat. This order is preserved until the browser is restarted and is reproducible regardless of the site being opened. <\/p>\n
For example, after creating the database \u00aba,b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,r\u00bb in one instance of Firefox, the method indexedDB.databases() will always return \u00abg,c,p,a,l,f,n,r,d,j,b,o,h,e,m,i,k\u00bb, while in another instance \u2014 \u00abj,b,o,h,e,m,i,k,f,n,r,d,g,c,p,a,l\u00bb. When creating 16 databases, around 44 bits of entropy can be obtained for identification. The generation of the identifier is not affected by clearing local browser storage or updating the Tor node chain by clicking the \u00abNew Identity\u00bb button in Tor Browser. The method can also be used for identifying users in a private browsing window. <\/p>\n
S\u00e5rbarheden skyldes en egenskab ved implementeringen af IndexedDB API'en, hvor r\u00e6kkef\u00f8lgen af databaser p\u00e5virkes af layoutet af interne strukturer, der er specifikke for hver instans af browserens arbejdsgang. R\u00e6kkef\u00f8lgen af elementene i databasen, der returneres af metoden indexedDB.databases(), afh\u00e6nger ikke af databasenavne eller r\u00e6kkef\u00f8lgen af oprettelsen, men af placeringen i den globale hash-tabel af interne UUID-hashes, der er tilknyttet filnavnene, hvori databaserne gemmes p\u00e5 disken. \n Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"