We found a stable Firefox identifier that links all of a user's private Tor identities

Using only the return order of indexedDB.databases(), it was possible to create an identifier that persists for the lifetime of the process in Firefox-based browsers.

• This identifier was shared at the process scope rather than the origin scope, allowing even unrelated sites to identify the same browser runtime.
• In Firefox Private Browsing, the identifier persisted as long as the Firefox process stayed alive even after closing all private windows, and it could persist even after New Identity in Tor Browser.
• The cause was that the Gecko IndexedDB implementation maps private database names to UUID-based filenames and exposes their internal ordering without sorting.
• Reproduction was possible by creating multiple IndexedDB databases and comparing the order from indexedDB.databases(), and the same permutation was repeatedly observed within the same process.
• As the number of controllable database names increased, the permutation space grew, meaning this signal provided sufficient entropy for fingerprinting purposes as well.
• Mozilla fixed this in Firefox 150 and ESR 140.10.0, tracked as Mozilla Bug 2024220.

The core mitigation is to return results normalized or sorted lexicographically so that ordering derived from the internal storage layout is not exposed externally.