CVE-2023-4580

Push notifications stored on disk in private browsing mode were not being encrypted potentially allowing the leak of sensitive information. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.

Score

CVSS 3.1 6.5 Medium

Status

Modified - security@mozilla.org

Published

2023-09-11

Last modified

2025-12-18

Weaknesses

CWE-311

Affected products

• Firefox (Mozilla)
• Firefox Esr (Mozilla)
• Thunderbird (Mozilla)

References

• https://bugzilla.mozilla.org/show_bug.cgi?id=1843046
• https://www.mozilla.org/security/advisories/mfsa2023-34/
• https://www.mozilla.org/security/advisories/mfsa2023-36/
• https://www.mozilla.org/security/advisories/mfsa2023-38/