Description
IndexedDB should be cleared when leaving private browsing mode and it is not, the API for WKWebViewConfiguration was being used incorrectly and requires the private instance of this object be deleted when leaving private mode. This vulnerability affects Firefox for iOS < 27.
Affected products
mozilla: firefox mobile
References4
- bugzilla.mozilla.org/show_bug.cgi?id=1646756 Issue TrackingPermissions RequiredVendor Advisory
- www.mozilla.org/security/advisories/mfsa2020-23/ Vendor Advisory
- bugzilla.mozilla.org/show_bug.cgi?id=1646756 Issue TrackingPermissions RequiredVendor Advisory
- www.mozilla.org/security/advisories/mfsa2020-23/ Vendor Advisory
Metrics
- CVSS 3.1
-
6.5
MEDIUM
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - EPSS — exploit probability
- 1% percentile: 52 · as of 2 November 2026
- CWE
- CWE-459
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.