CVE-2024-4767

What it actually does

IndexedDB data files persist on disk after closing the browser window when the browser.privatebrowsing.autostart preference is enabled, allowing potential exposure of data that should have been cleared in private mode.

Why it matters to the business

Organizations using affected browsers risk unintended retention of user activity data on endpoints, which could lead to privacy compliance issues or data exposure if devices are accessed by unauthorized parties.

How an attack unfolds

An attacker with local file system access examines residual IndexedDB files left behind after a private browsing session closes on a system where the autostart preference was active, retrieving data that should have been ephemeral.

How to fix it

Upgrade Firefox to 126 or later, Firefox ESR to 115.11 or later, and Thunderbird to 115.11 or later to enforce proper IndexedDB file deletion when private browsing ends.

How to confirm the fix worked

Confirm installed browser versions meet or exceed the fixed releases, enable the autostart preference in a test profile, perform private browsing, close the window, and verify no IndexedDB artifacts remain in the profile storage directories.

Typical attack path

1. Confirm or set browser.privatebrowsing.autostart preference to enabled
2. Conduct browsing sessions in private mode
3. Close the browser window
4. Locate and inspect remaining IndexedDB files in the profile directory on disk

How to detect it

Review endpoint browser version logs and file system artifacts in user profile directories for unexpected IndexedDB files persisting after private browsing sessions with autostart enabled.

What your security team should do

• Apply browser updates to patched versions across all endpoints without delay
• Inventory and replace any instances of Firefox below 126 or ESR below 115.11 and Thunderbird below 115.11
• Review private browsing configurations and disable autostart unless explicitly required