Mozilla Foundation Security Advisory 2016-63
Favicon network connection can persist when page is closed
- Announced
- August 2, 2016
- Reporter
- Toni Huttunen
- Impact
- High
- Products
- Firefox, Firefox ESR
- Fixed in
-
- Firefox 48
- Firefox ESR 45.3
Description
Security researcher Toni Huttunen reported that once the favicon is requested from a site, the remote server can keep the favicon network connection open even when the page is later closed. This allows a malicious site to continue to use this channel to send requests to the browser, leading to potential information disclosure, such as tracking the user across multiple IP addresses as the user changes networks.