CVE-2023-25750

What it actually does

In private browsing mode, a ServiceWorker's offline cache can be written to the local file system under certain conditions, exposing cached resources that should remain isolated from disk storage.

Why it matters to the business

Low-risk exposure of cached web content on user systems when private browsing is expected to prevent any local traces, with limited operational impact given the low severity and absence of known exploitation.

How an attack unfolds

An attacker crafts a web page that registers a ServiceWorker to populate an offline cache, then lures a victim into visiting the page while private browsing mode is active; under specific circumstances the cache persists to disk instead of remaining memory-only.

How to fix it

Upgrade Mozilla Firefox to version 111 or later on all affected systems to prevent the cache leakage in private browsing mode.

How to confirm the fix worked

Confirm installed Firefox version is 111 or higher; test private browsing sessions against a ServiceWorker-enabled site and verify no cache artifacts appear on disk after session termination.

Typical attack path

1. Host a malicious site that registers a ServiceWorker and triggers offline cache population
2. Social-engineer the victim into opening the site in private browsing mode
3. Trigger the cache-leak condition to write cached resources to the file system
4. Access the leaked cache files on the victim's machine for further analysis

How to detect it

Review Firefox update logs and installed versions; inspect user profile directories for unexpected offline cache directories created during private browsing; no widespread exploitation indicators exist due to lack of KEV listing or public exploits.

What your security team should do

• Prioritize updating all Firefox instances to version 111 or newer
• Monitor browser update compliance across the environment
• Review private browsing policies and user training for high-risk populations