Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
Firefox may let bad website discover internal computers
published 5 days ago
Summary
A specially crafted web page can use Firefox's built-in communication feature to look for other devices on your internal network and see what services are running on your own computer. This could give attackers a map of your internal systems without needing any software installed. Update Firefox (including the ESR version) to the latest release, or disable the WebRTC feature in the browser settings, to block this scanning behavior.
What to do
- Update cleanstart firefox to version 87.0-r0.
- Update cleanstart firefox-esr to version 78.9.0-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | firefox |
< 87.0-r0 Fix: upgrade to 87.0-r0
|
| CleanStart | cleanstart | firefox-esr |
< 78.9.0-r0 Fix: upgrade to 78.9.0-r0
|
Original advisory text
Using techniques that built on the slipstream research, a malicious webpage could have scanned both an internal network's hosts as well as services running on the user's local machine utilizing Web...
CVE-2021-23982 affects multiple packages. Using techniques that built on the slipstream research, a malicious webpage could have scanned both an internal network's hosts as well as services running on the user's local machine utilizing WebRTC connections. See references for individual vulnerability details.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published30 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2024-QD64034 · OSV
Track software like this
Free during beta