CVE-2023-32208

What it actually does

A service worker can leak the base URL of a script when using dynamic import() statements, resulting in unintended information disclosure of script locations.

Why it matters to the business

Attackers may gain insight into web application structure or internal paths, potentially facilitating targeted follow-on attacks against browser users.

How an attack unfolds

An attacker hosts a malicious site that registers a service worker. The service worker invokes dynamic import() to fetch a script, causing the browser to disclose the script base URL through observable network or storage channels to the attacker-controlled context.

How to fix it

Update Mozilla Firefox to version 113 or later on all affected systems.

How to confirm the fix worked

Confirm installed Firefox version is 113 or higher; test service worker dynamic import behavior with controlled proof-of-concept pages.

Typical attack path

1. Attacker delivers malicious web content to the victim
2. Service worker is registered and activated
3. Dynamic import() is triggered within the worker
4. Script base URL is leaked to attacker-controlled endpoint

How to detect it

Inspect browser console and network logs for unexpected service worker registrations combined with dynamic import requests that expose script URLs.

What your security team should do

• Apply Firefox 113+ updates across the environment as soon as possible
• Review browser update policies and enforce automatic updates where feasible
• Monitor browser telemetry or logs for anomalous service worker activity