CVE-2023-3482

What it actually does

Bypasses cookie storage blocking by allowing data to be written to localStorage via an about:blank iframe even when all cookies are configured to be blocked.

Why it matters to the business

Enables unauthorized tracking of users who have explicitly disabled cookie storage, eroding privacy protections and potentially exposing organizations to regulatory or reputational risk from non-compliant tracking.

How an attack unfolds

An attacker hosts a page that embeds an about:blank iframe; when the victim visits while cookie blocking is enabled, the iframe context permits localStorage writes that persist for tracking purposes.

How to fix it

Upgrade Mozilla Firefox to version 115 or later; enforce automatic browser updates across the environment.

How to confirm the fix worked

Confirm installed Firefox version is 115 or higher; reproduce the original test case with cookie blocking enabled and verify that localStorage writes from about:blank iframes are prevented.

Typical attack path

1. Victim visits attacker-controlled site with cookie blocking enabled
2. Page loads an about:blank iframe
3. Script writes tracking identifiers into localStorage
4. Identifiers are later read for cross-session tracking or profiling

How to detect it

Examine browser localStorage contents for unexpected persistent keys from sites that should be blocked; review Firefox update logs and version telemetry for instances still running versions prior to 115.

What your security team should do

• Prioritize immediate deployment of Firefox 115+ to all managed endpoints
• Enable browser auto-update policies
• Review privacy configurations that block cookies and test equivalent protections for localStorage