CVE-2023-4580

What it actually does

Push notifications are stored in plaintext on disk instead of being encrypted when private browsing mode is active, exposing notification content that should remain protected.

Why it matters to the business

Organizations may face privacy compliance issues and loss of user trust if sensitive notification data from private sessions becomes accessible through local disk access.

How an attack unfolds

An attacker with access to the user's filesystem locates the unencrypted notification storage files created during private browsing sessions and reads the sensitive content directly.

How to fix it

Upgrade Firefox to version 117 or later, Firefox ESR to 115.2 or later, and Thunderbird to 115.2 or later to ensure encryption is applied to private browsing notifications.

How to confirm the fix worked

Verify installed product versions meet or exceed the fixed releases and inspect notification storage locations to confirm encryption is now enforced for private mode data.

Typical attack path

1. Obtain local filesystem access on a target system
2. Navigate to the browser profile or notification cache directory
3. Identify and read unencrypted push notification records from private browsing sessions

How to detect it

Examine browser profile directories and notification cache files for plaintext push notification entries created during private browsing; correlate with file access timestamps from local users or processes.

What your security team should do

• Prioritize patching all instances of affected Mozilla products to the fixed versions
• Review endpoint protection policies to limit unauthorized local filesystem access
• Monitor for any future updates to private browsing encryption behavior