CVE-2023-6208

What it actually does

The browser erroneously copies text selected via the Selection API into the X11 primary selection buffer, exposing page content to any local process that can read that buffer.

Why it matters to the business

Sensitive information displayed in the browser can leak to other applications running on the same system, increasing the risk of data exposure on shared or compromised workstations.

How an attack unfolds

An attacker hosts a malicious page that triggers the Selection API on content containing credentials or session tokens; because the browser writes that text into the X11 primary selection, any local process or malware can retrieve it without further interaction.

How to fix it

Upgrade Firefox to version 120 or later, Firefox ESR to 115.5.0 or later, and Thunderbird to 115.5 or later. On systems where immediate upgrade is not possible, disable X11 primary selection integration or run the browser under a different display server.

How to confirm the fix worked

Confirm the browser version meets or exceeds the fixed releases and test that the Selection API no longer populates the primary selection buffer on X11.

Typical attack path

1. Victim visits attacker-controlled page in an affected browser on X11
2. Page uses Selection API to select sensitive text
3. Browser writes selection into X11 primary selection buffer
4. Local attacker or malware reads the buffer via standard X11 tools or APIs
5. Exfiltrated data is used for further compromise

How to detect it

Review browser update logs and package manager history for installations older than the fixed releases; inspect X11 selection buffer access patterns in process execution logs for unexpected readers after browser sessions.

What your security team should do

• Prioritize patching all Firefox, ESR, and Thunderbird instances to the fixed versions
• Inventory Linux desktops using X11 and schedule display server migrations where feasible
• Add browser version checks to endpoint compliance scans
• Monitor for unusual local processes accessing X11 selection buffers on high-risk hosts