Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
Librewolf may load tampered script from cache
published 4 days ago
Summary
Librewolf’s handling of a safety check that verifies a script’s identity can be fooled if an attacker can insert code. The attacker can cause the browser to reuse an old, cached script whose verification data does not match, allowing malicious code to run. Update Librewolf to the newest version or apply any available security patches to fix the issue.
What to do
- Update cleanstart librewolf to version 103.0-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | librewolf |
< 103.0-r0 Fix: upgrade to 103.0-r0
|
Original advisory text
When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of previously cached entries with incorrect, different integrity metadata
Security vulnerability affects the librewolf package. When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of previously cached entries with incorrect, different integrity metadata.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published31 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2024-AS26968 · OSV
Track software like this
Free during beta