@kazani
"We Found a Stable Firefox Identifier Linking All Your Private Tor Identities"
https://fingerprint.com/blog/firefox-tor-indexeddb-privacy-vulnerability/
A privacy vulnerability was discovered in Firefox-based browsers that allows websites to create a stable, process-lifetime identifier from the order of IndexedDB databases.
This identifier can link activity across unrelated websites during the same browser runtime, even in private browsing modes.
In Firefox Private Browsing, the identifier can persist after private windows are closed, as long as the browser process remains active.
The vulnerability bypasses Tor Browser's 'New Identity' feature, which is intended to reset user activity and provide unlinkability.
The issue stems from the indexedDB.databases() API returning database metadata in an order derived from internal storage structures rather than creation order.
This order is deterministic for a given browser process and is shared across all origins, making it a cross-site tracking vector.
The vulnerability breaks user expectations that unrelated websites cannot identify the same browser instance and that private session data is cleared upon session end.
Mozilla has released a fix in Firefox 150 and ESR 140.10.0, addressing the underlying IndexedDB implementation.
The fix involves canonicalizing or sorting the results of indexedDB.databases() to remove the identifying entropy.
This vulnerability highlights how seemingly harmless implementation details can lead to significant privacy leaks and emphasizes the importance of careful design in privacy-sensitive features.