{"id":169865,"date":"2026-04-23T18:24:28","date_gmt":"2026-04-23T16:24:28","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-api-indexeddb-pozvolyayushhaya-identificzirovat-polzovatelej-firefox-i-tor-browser"},"modified":"2026-04-23T18:24:28","modified_gmt":"2026-04-23T16:24:28","slug":"uyazvimost-v-api-indexeddb-pozvolyayushhaya-identificzirovat-polzovatelej-firefox-i-tor-browser","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-api-indexeddb-pozvolyayushhaya-identificzirovat-polzovatelej-firefox-i-tor-browser","title":{"rendered":"Zranite\u013enos\u0165 v API IndexedDB, ktor\u00e1 umo\u017e\u0148uje identifikova\u0165 pou\u017e\u00edvate\u013eov Firefox a Tor Browser","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
V prehliada\u010dovom eng\u00edne Gecko bola zisten\u00e1 zranite\u013enos\u0165 (CVE-2026-6770), ktor\u00e1 umo\u017e\u0148uje vytv\u00e1ra\u0165 jedine\u010dn\u00e9 identifik\u00e1tory na sledovanie otvorenia r\u00f4znych str\u00e1nok z jedn\u00e9ho prehliada\u010da. Probl\u00e9m sa objavuje vo v\u0161etk\u00fdch prehliada\u010doch zalo\u017een\u00fdch na Firefox, vr\u00e1tane Tor Browser, a funguje aj v re\u017eime s\u00fakromn\u00e9ho prehliadania. Identifik\u00e1tory platia v r\u00e1mci aktu\u00e1lneho procesu prehliada\u010da a s\u00fa vymazan\u00e9 po re\u0161tartovan\u00ed prehliada\u010da. Zranite\u013enos\u0165 bola odstr\u00e1nen\u00e1 vo verzi\u00e1ch Firefox 150\/140.10.0 a Tor Browser 15.0.10. <\/p>\n
Na vytvorenie identifik\u00e1tora sta\u010d\u00ed na r\u00f4znych str\u00e1nkach vytvori\u0165 prostredn\u00edctvom API IndexedDB rovnak\u00fa sekvenciu datab\u00e1z, po \u010dom sa vyhodnot\u00ed poradie nasleduj\u00facich datab\u00e1z v d\u00f4sledku volania met\u00f3dy indexedDB.databases(). Pre r\u00f4zne in\u0161tancie prehliada\u010da sa poradie vypisovania datab\u00e1z bude l\u00ed\u0161i\u0165, ale pre jednu in\u0161tanciu sa opakuje. Tak\u00e9to poradie sa zachov\u00e1 a\u017e po re\u0161tarte prehliada\u010da a reprodukuje sa nez\u00e1visle od otvorenej str\u00e1nky. <\/p>\n
Napr\u00edklad, po vytvoren\u00ed datab\u00e1zy \u201ea,b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,r\u201c v jednom in\u0161tancii Firefoxu met\u00f3da indexedDB.databases() v\u017edy vr\u00e1ti \u201eg,c,p,a,l,f,n,r,d,j,b,o,h,e,m,i,k\u201c, zatia\u013e \u010do v inej in\u0161tancii to bude \u201ej,b,o,h,e,m,i,k,f,n,r,d,g,c,p,a,l\u201c. Pri vytvoren\u00ed 16 datab\u00e1z je mo\u017en\u00e9 z\u00edska\u0165 pribli\u017ene 44 bitov entropie na identifik\u00e1ciu. Na gener\u00e1ciu identifik\u00e1tora nem\u00e1 vplyv vy\u010distenie lok\u00e1lnych prehliada\u010dov\u00fdch \u00falo\u017e\u00edsk a aktualiz\u00e1cia re\u0165azca uzlov Tor tla\u010didlom \u201eNew Identity\u201c v Tor Browser. Met\u00f3da sa tie\u017e m\u00f4\u017ee pou\u017e\u00edva\u0165 na identifik\u00e1ciu pou\u017e\u00edvate\u013eov v okne s\u00fakromn\u00e9ho prehliadania. <\/p>\n
Zranite\u013enos\u0165 je sp\u00f4soben\u00e1 osobitos\u0165ou implement\u00e1cie API IndexedDB, kde poradie v\u00fdskytu DB ovplyv\u0148uje usporiadanie vn\u00fatorn\u00fdch \u0161trukt\u00far, ktor\u00e9 je \u0161pecifick\u00e9 pre ka\u017ed\u00fa in\u0161tanciu pracovn\u00e9ho procesu prehliada\u010da. Poradie prvkov v zozname DB, ktor\u00fd met\u00f3da indexedDB.databases() vracia, nez\u00e1vis\u00ed od n\u00e1zvov DB alebo od poradia ich vytvorenia, ale od umiestnenia v glob\u00e1lnej hash tabu\u013eke vn\u00fatorn\u00fdch UUID-hashov, ktor\u00e9 s\u00fa spojen\u00e9 s n\u00e1zvami s\u00faborov, v ktor\u00fdch s\u00fa DB ulo\u017een\u00e9 na disku. \n Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"