CVE-2023-34415
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
A vulnerability in Firefox allowed a document loaded from a data: URL resulting from a redirect to be loaded in the same process as the site that issued the redirect, bypassing site-isolation protections against Spectre-like attacks.
Risk Assessment
Organizations may be exposed to attacks leveraging open redirects, potentially leading to data exposure or other security threats.
Recommendation
It is recommended to update Firefox to version 114 or newer to mitigate this vulnerability.
Other vulnerabilities in Firefox < 114
See all- CVE-2026-92079Critical
Mitigation bypass vulnerability in the Widget: Win32 component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92075Critical
Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92071Critical
Sandbox escape vulnerability due to incorrect boundary conditions in the Widget: Win32 component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92066Critical
Sandbox escape in the Profile Backup component of Firefox and Thunderbird. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
- CVE-2026-92061Critical
Incorrect boundary conditions in the Security: Process Sandboxing component. Fixed in Firefox 156 and Thunderbird 156.
- CVE-2026-92057Critical
Mitigation bypass vulnerability in the Enterprise Policies component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92051Critical
Spoofing issue due to invalid pointer in the Graphics component. Fixed in Firefox 156 and Thunderbird 156.
- CVE-2026-92048Critical
Sandbox escape vulnerability due to incorrect boundary conditions in the Widget: Win32 component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92045Critical
Sandbox escape vulnerability due to incorrect boundary conditions in the WebRTC component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92037Critical
Incorrect boundary conditions in the DOM: Animation component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
Original NVD description (English source)
When choosing a site-isolated process for a document loaded from a data: URL that was the result of a redirect, Firefox would load that document in the same process as the site that issued the redirect. This bypassed the site-isolation protections against Spectre-like attacks on sites that host an "open redirect". Firefox no longer follows HTTP redirects to data: URLs. This vulnerability affects Firefox < 114.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS