CVE-2023-29538

What it actually does

Under specific load conditions a WebExtension receives a jar:file:/// URI instead of the expected moz-extension:/// URI, disclosing local directory paths on the host.

Why it matters to the business

Limited local path disclosure may assist attackers in reconnaissance or follow-on attacks; the issue has been public for over three years with negligible observed exploitation and stable low EPSS.

How an attack unfolds

An attacker develops or compromises a WebExtension that triggers a resource load under the specific circumstances that cause the browser to substitute a jar:file URI, allowing the extension to observe and exfiltrate the leaked host directory paths.

How to fix it

Upgrade Mozilla Firefox and Focus for Android to version 112 or newer; remove or disable any untrusted WebExtensions until patches are applied.

How to confirm the fix worked

Confirm installed browser versions are 112 or later; review extension update history and test load requests with sample extensions to ensure moz-extension URIs are consistently returned.

Typical attack path

1. Develop or obtain a WebExtension capable of initiating the affected load sequence
2. Distribute the extension to the target browser
3. Trigger the load request that elicits the jar:file:/// URI
4. Capture the disclosed directory path from the extension

How to detect it

Search browser and extension logs for unexpected jar:file:/// URIs; examine network or file-access telemetry from WebExtensions for path-like strings that do not begin with moz-extension.

• jar:file:///
• moz-extension URI replaced by file URI in extension load

What your security team should do

• Prioritize patching all Firefox and Focus instances to version 112+
• Audit installed WebExtensions and revoke unnecessary permissions
• Monitor extension-related logs for jar:file URIs as a temporary detection measure