{"id":169865,"date":"2026-04-23T18:24:28","date_gmt":"2026-04-23T16:24:28","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-api-indexeddb-pozvolyayushhaya-identificzirovat-polzovatelej-firefox-i-tor-browser"},"modified":"2026-04-23T18:24:28","modified_gmt":"2026-04-23T16:24:28","slug":"uyazvimost-v-api-indexeddb-pozvolyayushhaya-identificzirovat-polzovatelej-firefox-i-tor-browser","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-api-indexeddb-pozvolyayushhaya-identificzirovat-polzovatelej-firefox-i-tor-browser","title":{"rendered":"Vulnerability in the IndexedDB API allows for user identification in Firefox and Tor Browser.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A vulnerability (CVE-2026-6770) has been discovered in the Gecko browser engine, allowing the generation of unique identifiers for tracking the opening of different websites from a single browser. This issue manifests across all Firefox-based browsers, including Tor Browser, and operates even in private browsing mode. Identifiers exist within the current browser process and reset upon browser restart. The vulnerability has been fixed in Firefox releases 150\/140.10.0 and Tor Browser 15.0.10. <\/p>\n
To generate an identifier, it is sufficient to create the same sequence of databases through the IndexedDB API on different websites, after which you can evaluate the order of these databases as a result of calling the indexedDB.databases() method. The order of enumeration of the databases will vary across different browser instances, but it will remain consistent for a single instance. This order is maintained until the browser is restarted and is reproduced regardless of the site being opened. <\/p>\n
For example, after creating the databases \u2018a,b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,r\u2019 in one instance of Firefox, the indexedDB.databases() method will always return \u2018g,c,p,a,l,f,n,r,d,j,b,o,h,e,m,i,k\u2019 in that instance, while in another instance it will return \u2018j,b,o,h,e,m,i,k,f,n,r,d,g,c,p,a,l\u2019. Creating 16 databases can yield about 44 bits of entropy for identification. The generation of the identifier is unaffected by clearing local browser storage and by refreshing Tor nodes via the \u2018New Identity\u2019 button in the Tor Browser. The method can also be used for user identification in private browsing windows. <\/p>\n
The vulnerability arises from the implementation specifics of the IndexedDB API, where the order of database enumeration is influenced by the arrangement of internal structures unique to each instance of the browser's worker process. The order of elements in the list of databases returned by the indexedDB.databases() method depends not on the names of the databases or their creation order, but on the placement of internal UUID hashes associated with the filenames where the databases are stored on disk in the global hash table. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"