🔐 CVE Alert

CVE-2023-23602

MEDIUM 6.5

Content Security Policy wasn't being correctly applied to WebSockets in WebWorkers

CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th

A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src header to be ignored. This could lead to connections to restricted origins from inside WebWorkers. This vulnerability affects Firefox < 109, Firefox ESR < 102.7, and Thunderbird < 102.7.

Vendor mozilla
Product firefox
Ecosystems
Industries
Technology
Published Jun 2, 2023
Last Updated Dec 18, 2025
Stay Ahead of the Next One

Get instant alerts for mozilla firefox

Be the first to know when new medium vulnerabilities affecting mozilla firefox are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Mozilla / Firefox
unspecified < 109
Mozilla / Firefox ESR
unspecified < 102.7
Mozilla / Thunderbird
unspecified < 102.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗
bugzilla.mozilla.org: https://bugzilla.mozilla.org/show_bug.cgi?id=1800890 mozilla.org: https://www.mozilla.org/security/advisories/mfsa2023-01/ mozilla.org: https://www.mozilla.org/security/advisories/mfsa2023-02/ mozilla.org: https://www.mozilla.org/security/advisories/mfsa2023-03/

Credits

Dave Vandyke