CVE-2023-23603

What it actually does

Regular expressions filtering forbidden properties and values from style directives in console.log calls fail to account for external URLs, allowing data to be exfiltrated from the browser via crafted style directives.

Why it matters to the business

Users of affected browsers may have sensitive information leaked to attackers, resulting in privacy violations and potential exposure of personal or organizational data accessed through the browser.

How an attack unfolds

An attacker creates a malicious webpage that triggers console.log with style directives containing external URLs; the incomplete regex filter allows the directive to execute, sending browser data to an attacker-controlled server.

How to fix it

Upgrade Mozilla Firefox to 109 or later, Firefox ESR to 102.7 or later, and Thunderbird to 102.7 or later to ensure the regex filters properly handle external URLs.

How to confirm the fix worked

Confirm installed versions meet or exceed the fixed releases and test that console.log style directives containing external URLs are now blocked by the filters.

Typical attack path

1. Host a malicious webpage containing crafted console.log calls with external URLs in style directives
2. Lure a victim to visit the page using social engineering or compromised sites
3. Browser processes the unfiltered directive and exfiltrates data to the attacker's URL

How to detect it

Examine browser process logs and network traffic for unexpected outbound requests triggered by console activity; correlate with visits to untrusted domains around the time of potential exposure.

What your security team should do

• Apply browser updates immediately across all endpoints
• Enforce automatic updates for Mozilla products in enterprise environments
• Review browser policies to restrict console access where feasible