CVE-2023-28160

What it actually does

A redirect response pointing to a publicly accessible web extension file causes the browser to resolve and expose the underlying local filesystem path in the final URL instead of preserving the original remote reference, disclosing sensitive directory information.

Why it matters to the business

Attackers can obtain details about a user's local file layout, which may aid in crafting follow-on attacks or identifying installed software; the issue affects a widely deployed browser with no ransomware usage or known active exploitation campaigns.

How an attack unfolds

An attacker hosts or controls a page that issues a redirect to a web extension resource; when the browser follows the redirect, the local path is leaked in the address bar or request, allowing the attacker to capture the sensitive information via logs or scripts.

How to fix it

Upgrade Mozilla Firefox to version 111 or later; enable automatic updates and verify the installed version through the browser's about:support page.

How to confirm the fix worked

Confirm the browser version is 111 or newer; test by simulating a redirect to a known web extension file and verifying that only the original remote URL is retained without local path disclosure.

Typical attack path

1. Attacker crafts a page or service that returns a redirect targeting a publicly reachable web extension file URL
2. Victim browser follows the redirect while processing the response
3. Browser internally translates the extension reference to its local filesystem path
4. Leaked path appears in the final URL or network request, visible to the attacker-controlled origin

How to detect it

Examine web proxy, browser history, and extension-related logs for unexpected redirects involving web extension resources that result in local filesystem paths appearing in URLs; correlate with user reports of unusual path information in the address bar.

What your security team should do

• Prioritize deployment of Firefox 111+ across all managed endpoints within the next patching cycle
• Monitor EPSS and exploit maturity indicators for any future increase in activity
• Review browser telemetry and update policies to enforce rapid adoption of security releases