CVE-2023-4583
Browsing Context potentially not cleared when closing Private Window
- State
- Published
- Severity
- 7.5 High
- Published
- Sep 11, 2023
- Updated
- Dec 18, 2025
- Reserved
- Aug 29, 2023
Description
When checking if the Browsing Context had been discarded in `HttpBaseChannel`, if the load group was not available then it was assumed to have already been discarded which was not always the case for private channels after the private session had ended. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | CISA-ADP |
Weaknesses
- CWE-754 Improper Check for Unusual or Exceptional Conditions
Affected Products
| Product | Versions |
|---|---|
FirefoxMozilla |
|
Firefox ESRMozilla |
|
ThunderbirdMozilla |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.