Read the docs
TI-2020-09932 Aliases CVE-2020-12414GHSA-68g9-f9xv-qr8g

IndexedDB should be cleared when leaving private browsing mode and it is not, the API for…

Priority LOW 30CWE-459Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

IndexedDB should be cleared when leaving private browsing mode and it is not, the API for WKWebViewConfiguration was being used incorrectly and requires the private instance of this object be deleted when leaving private mode. This vulnerability affects Firefox for iOS < 27.

Why it matters now

EPSS 0.0068 52nd percentileScored 2026-11-07
Fix Fixed Firefox for iOS (Mozilla): 27

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MozillaFirefox for iOSbefore 2727Patch availableCNA
  • Firefox for iOS VendorMozilla Affected before 27 Fixed in 27 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mozilla:firefox_mobile:*:*:*:*:*:iphone_os:*:*before 27.0VulnerableMozilla
  • cpe:2.3:a:mozilla:firefox_mobile:*:*:*:*:*:iphone_os:*:* Versions before 27.0 Vulnerable ·Mozilla

Remediation

  • Fix · CNA Firefox for iOS (Mozilla) Fixed in 27

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-12414
  2. 2026-10-03 Alias added: GHSA-68g9-f9xv-qr8g

References

Advisory 2

  • TI-2022-09832 Use after free in Mozilla Firefox KEVCVSS 3.1CRITICAL 9.6
  • TI-2022-09831 Use after free in Mozilla Firefox KEVCVSS 3.1HIGH 8.8
  • TI-2023-13905 Race condition in Mozilla Firefox for Android CVSS 3.1HIGH 7.5
  • TI-2023-13916 A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization… CVSS 3.1MEDIUM 6.5
  • TI-2023-13903 Following a Garbage Collector compaction, weak maps may have been accessed before they… CVSS 3.1MEDIUM 6.5
  • TI-2022-13642 Information disclosure in Mozilla Firefox for iOS CVSS 3.1MEDIUM 6.5
See all 86 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences