Securityaffairs.Co Firefox Bug CVE-2026-6770 Allows Tracking of Tor Users
Article Content
- •CVE-2026-6770 allows tracking of Firefox and Tor users via IndexedDB.
- •The vulnerability affects both normal and Private Browsing modes.
- •Patches were released in Firefox 150 and Tor Browser 15.0.10 on April 21, 2026.
A newly discovered vulnerability, CVE-2026-6770, allows attackers to fingerprint users of Firefox and Tor browsers, even in Private Browsing mode. The flaw, identified in the IndexedDB API, enables the creation of a database that can be queried to track users across different sessions. This vulnerability affects both standard and private browsing modes in Firefox and the Tor Browser, undermining the privacy protections intended by Tor's New Identity feature. Mozilla has released patches in Firefox 150 and Tor Browser 15.0.10 to address this issue. The bug went largely unnoticed amid other security discussions, despite its significant implications for user privacy. Users are advised to update their browsers promptly to mitigate the risk of being tracked. The vulnerability was publicly disclosed on April 21, 2026, and the patches were released shortly thereafter.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (3)
Following this threat?
Track CVE-2026-6770 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active… 
Critical Authentication Bypass in Rejetto HFS Exploited Within 24 Hours Anthropic's Mythos model identified a critical authentication bypass in Rejetto HTTP File Server (HFS), tracked as CVE-2026-61500, allowing remote code execution. Discovered by Horizon3 researcher Zach Hanley, the flaw was revealed on September 27, 2026, and exploitation began within 24 hours, with attacks traced to…