CVE-2021-43540

What it actually does

WebExtensions granted the required permissions can register and install ServiceWorkers scoped to arbitrary third-party origins; these workers are not removed during extension uninstall, leaving persistent background execution contexts.

Why it matters to the business

Organizations face ongoing risk of unauthorized background scripts on user browsers that survive extension removal, enabling stealthy tracking or actions without ongoing user or admin visibility.

How an attack unfolds

An attacker crafts a signed or sideloaded WebExtension requesting ServiceWorker-related permissions, convinces users to install it, registers persistent workers for chosen third-party sites, then removes the extension so the workers continue executing independently.

How to fix it

Upgrade all affected Mozilla Firefox installations to version 95 or later; audit and remove extensions that request broad ServiceWorker permissions.

How to confirm the fix worked

Confirm Firefox version is 95 or higher via about:support; enumerate registered ServiceWorkers in about:serviceworkers and verify none persist from previously uninstalled extensions.

Typical attack path

1. Attacker publishes or distributes a WebExtension with ServiceWorker permissions
2. User installs the extension
3. Extension registers ServiceWorkers for target third-party origins
4. Extension is uninstalled or removed
5. ServiceWorkers remain active and execute on the target sites

How to detect it

Inspect about:serviceworkers and extension storage for registrations originating from extensions no longer present; review browser console or telemetry logs for ServiceWorker install events tied to removed add-ons.

• about:serviceworkers
• ServiceWorker register for third-party origin without active extension
• persistent worker script after extension uninstall

What your security team should do

• Immediately upgrade Firefox to 95 or newer across the environment
• Review and restrict WebExtension permissions in enterprise policies
• Monitor browser update compliance and extension inventories