CVE-2023-28161
📋 TL;DR
This vulnerability allows temporary permissions granted to local HTML files (loaded via file: URLs) to persist across different local files in the same browser tab. An attacker could trick a user into granting camera/microphone access to one local file, then use that permission to access sensitive data from other local files. This affects Firefox users running versions below 111.
💻 Affected Systems
- Mozilla Firefox
📦 What is this software?
Firefox by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
An attacker could gain persistent access to camera/microphone feeds by tricking a user into granting permissions to a malicious local HTML file, then accessing other local files containing sensitive information.
Likely Case
Local file permissions leakage allowing unauthorized access to device resources (camera, microphone, location) across different local HTML files in the same browsing session.
If Mitigated
Minimal impact if users avoid granting permissions to local files or if browser is updated to version 111+.
🎯 Exploit Status
Exploitation requires user interaction (granting permissions) and access to local file system. No known public exploits.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox 111
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2023-09/
Restart Required: Yes
Instructions:
1. Open Firefox. 2. Click menu → Help → About Firefox. 3. Allow Firefox to check for updates. 4. Restart Firefox when prompted. 5. Verify version is 111 or higher.
🔧 Temporary Workarounds
Disable local file permissions
allPrevent Firefox from requesting permissions for local files
about:config → media.navigator.permission.disabled = true
about:config → dom.webnotifications.enabled = false
Avoid local HTML files
allDo not open HTML files from local file system in Firefox
🧯 If You Can't Patch
- Avoid downloading and opening HTML files from untrusted sources
- Clear browser permissions regularly: about:preferences#privacy → Permissions → Settings
🔍 How to Verify
Check if Vulnerable:
Check Firefox version: if below 111 and you use local HTML files with permissions, you are vulnerable.Check Version:
firefox --version (Linux/macOS) or check Help → About Firefox (all platforms)Verify Fix Applied:
Verify Firefox version is 111 or higher and test that permissions don't persist across different local HTML files.📡 Detection & Monitoring
Log Indicators:
- Multiple permission requests from file: URLs in same session
- Camera/microphone access from local files
Network Indicators:
- None - this is a local file system vulnerability
SIEM Query:
source="firefox" AND (url="file:*" AND permission_granted="true")