CVE-2022-45417

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-12-22 · updated 2026-06-17
Weakness: CWE-1021

Description

Service Workers did not detect Private Browsing Mode correctly in all cases, which could have led to Service Workers being written to disk for websites visited in Private Browsing Mode. This would not have persisted them in a state where they would run again, but it would have leaked Private Browsing Mode details to disk. This vulnerability affects Firefox < 107.

Affected products

Mozilla Firefox: before 107.0 — fixed in 107.0

How to fix

Upgrade to a fixed version: Mozilla Firefox 107.0. Check the vendor advisory for mitigations.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1794508
https://www.mozilla.org/security/advisories/mfsa2022-47/
https://bugzilla.mozilla.org/show_bug.cgi?id=1794508
https://www.mozilla.org/security/advisories/mfsa2022-47/
https://bugzilla.mozilla.org/show_bug.cgi?id=1794508

Get alerted when CVE-2022-45417 or the next vulnerability affects your stack