CVE-2025-10859Medium· 4.0▾ SunlitCookie storage for non-HTML temporary documents was being shared incorrectly with normal browsing content, allowing information from private tabs to escape Incognito mode even after the user closed all tabs. This vulnerability was fixed …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 22 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.1%
Last analysed / modified upstream
Cookie storage for non-HTML temporary documents was being shared incorrectly with normal browsing content, allowing information from private tabs to escape Incognito mode even after the user closed all tabs. This vulnerability was fixed in Firefox for iOS 143.1.
firefox < 143.1.0Upgrade past the affected range:
firefox 143.1.0Connected by shared product, vendor, weakness, or advisory.
CVE-2025-1939Low· 3.9Android apps can load web pages using the Custom Tabs feature
CVE-2026-118008High· 8.8Privilege escalation in the DOM: Navigation component
CVE-2026-117999NoneRace condition in the IPC component
CVE-2026-117976NoneSite isolation issue in the DOM: Navigation component
CVE-2026-118027NoneFrame poisoning in the Layout component
CVE-2026-118024NoneUse-after-free in the Graphics: Text component