Stable Firefox identifier discovered that links all private Tor identities

The indexedDB.databases() API in Firefox-based browsers exposed a deterministic and stable order based on internal storage structure, allowing websites to construct a process-lifetime identifier.

Within the same browser process, this identifier persisted across Private Browsing sessions and even across Tor Browser's New Identity, and different sites could observe the same order, enabling cross-origin tracking.

The root cause was that in Private Browsing, database names went through a global hash table with UUID mapping, and lookups returned results in unsorted hash-set traversal order. As a result, the order was determined not by creation order but by internal bucket placement and insertion history.

The scope of impact is as follows.

• cross-origin linkability: different domains could identify the same running Firefox/Tor process
• private-session persistence: the identifier could persist even after all Private windows were closed, as long as the Firefox process stayed alive
• Tor Browser isolation break: linkable within the same process even after a New Identity

The author responsibly disclosed this to Mozilla and the Tor Project, and Mozilla fixed it in Firefox 150 and ESR 140.10.0. The relevant tracking is Mozilla Bug 2024220, and the fundamental fix is to return results in a canonical order such as lexicographic sorting, so that internal storage state cannot become a fingerprinting signal.