CVE-2023-28161

What it actually does

Temporary one-time permissions granted to documents loaded via file: URLs persist for all subsequent file: URL documents in the same tab, bypassing per-document isolation.

Why it matters to the business

Organizations face elevated risk of unauthorized local file access or camera/microphone use when users open untrusted downloaded files in the same browser tab, potentially exposing sensitive data or enabling further compromise.

How an attack unfolds

An attacker prepares a local file that requests a one-time permission such as camera access; once granted by the user the permission remains active allowing a second malicious local file loaded in the same tab to abuse the permission without re-prompting.

How to fix it

Upgrade all instances of Firefox to version 111 or later to restore proper per-document permission scoping for file: URLs.

How to confirm the fix worked

Confirm installed Firefox version is 111 or higher; test by granting a one-time permission to one file: URL document and verifying the permission is not available to a second distinct file: URL document in the same tab.

Typical attack path

1. User downloads multiple files from different sources into a shared directory
2. User opens first file via file: URL and grants temporary permission
3. Attacker loads second file via file: URL in the same tab
4. Second file silently reuses the persisted permission to access camera, microphone or other resources

How to detect it

Review browser permission logs and download histories for repeated file: URL loads in the same tab shortly after permission grants; examine process execution or network activity following local file opens for signs of unexpected camera or microphone use.

What your security team should do

• Prioritize immediate upgrade of all Firefox deployments to version 111 or newer
• Restrict or monitor use of file: URLs in enterprise browser policies
• Educate users on the risks of opening files from untrusted sources in the same tab