Firefox bug CVE-2026-6770 enabled cross-site tracking and Tor fingerprinting

Security Affairs

April 27, 2026 at 10:49 AM

Overview

A recently discovered vulnerability, tracked as CVE-2026-6770, allowed attackers to track and fingerprint users of Firefox and the Tor Browser, even when they were using Private Browsing mode. This flaw could bypass Tor's New Identity feature, which is designed to enhance privacy. As a result, both Firefox version 150 and Tor Browser version 15.0.10 have released updates to address this issue. This vulnerability is particularly concerning because it compromises the privacy protections that users rely on, especially those using Tor for anonymous browsing. Users are urged to update their browsers promptly to protect against this tracking risk.

Key Takeaways

Affected Systems: Firefox version 150, Tor Browser version 15.0.10
Action Required: Users should update to Firefox version 150 and Tor Browser version 15.
Timeline: Newly disclosed

Original Article Summary

CVE-2026-6770 let attackers fingerprint Firefox and Tor users, even in Private mode. Firefox 150 and Tor Browser 15.0.10 fixed it. A vulnerability, tracked as CVE-2026-6770, allowed attackers to fingerprint Firefox users, even in Private Browsing, and also impacted the Tor Browser. The flaw worked even when Tor’s New Identity feature was used, bypassing protections meant […]

Impact

Firefox version 150, Tor Browser version 15.0.10

Exploitation Status

No active exploitation has been reported at this time. However, organizations should still apply patches promptly as proof-of-concept code may exist.

Timeline

Newly disclosed

Remediation

Users should update to Firefox version 150 and Tor Browser version 15.0.10 to mitigate this vulnerability.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to CVE, Vulnerability, Update.

Read Original Article

Related Coverage

OpenSSH Flaw Allowing Full Root Shell Access Lurked for 15 Years

SecurityWeek

A significant vulnerability in OpenSSH has been discovered, allowing attackers to gain full root shell access to affected systems. This flaw, which has been present for 15 years, stems from a coding issue that misinterprets comma characters in certificate principals as list separators. As a result, unauthorized users could exploit this vulnerability to escalate privileges and take control of systems. OpenSSH is widely used for secure remote access, making this a serious concern for organizations relying on it for security. Users and administrators are urged to review their systems and apply any available patches to mitigate this risk.

Apr 27, 2026

Malicious AI Prompt Injection Attacks Increasing, but Sophistication Still Low: Google

SecurityWeek

Google has reported an increase in malicious AI prompt injection attacks, although many of these attempts are not sophisticated and pose little harm. Some of these exploits have been identified as potentially dangerous, indicating that while attackers are becoming more active, their methods remain relatively basic. The findings suggest that users and organizations interacting with AI systems should be aware of the risks associated with prompt injections. As AI technology continues to evolve, the security implications of these attacks could become more significant, making it essential for developers and users alike to stay vigilant and informed about the potential for exploitation.

Apr 27, 2026

PhantomCore Exploits TrueConf Vulnerabilities to Breach Russian Networks

The Hacker News

PhantomCore, a pro-Ukrainian hacktivist group, has been targeting TrueConf video conferencing software in Russia since September 2025. Researchers from Positive Technologies reported that the group is exploiting a series of three vulnerabilities to gain remote access to affected systems. This attack is significant as it affects servers that may be crucial for communications in various sectors, potentially disrupting operations and compromising sensitive information. The ongoing nature of these attacks raises concerns for organizations using TrueConf, as they may be at risk of unauthorized access and data breaches. Users of this software are advised to remain vigilant and implement security measures to protect their systems.

Apr 27, 2026

UNC6692 Uses Email Bombing, Social Engineering to Deploy ‘Snow’ Malware

SecurityWeek

A group identified as UNC6692 is using email bombing tactics and social engineering to spread the Snow malware family, which includes variants like Snowbelt, Snowglaze, and Snowbasin. This malware provides attackers with persistent access to infected systems, raising significant concerns for both individuals and organizations. The methods employed, such as overwhelming targets with emails to trick them into clicking malicious links, illustrate the evolving strategies cybercriminals use to gain entry. Victims of this campaign may face data theft or further exploitation, making it crucial for users to remain vigilant against suspicious emails and to enhance their cybersecurity measures. As these types of attacks become more sophisticated, organizations need to prioritize employee training on recognizing phishing attempts and implementing strong security protocols.

Apr 27, 2026

US Launches Sweeping Crackdown on Southeast Asia Cyberscams and Sanctions Cambodian Senator

SecurityWeek

The U.S. has launched a significant crackdown on cyberscam operations in Southeast Asia, which officials are describing as a new front in the fight against cybercrime. This initiative includes sanctions against a Cambodian senator believed to be involved in facilitating these scams. The crackdown aims to dismantle networks that have been scamming individuals, particularly targeting vulnerable populations in the region. By taking these actions, U.S. authorities hope to disrupt the operations and reduce the impact of these scams, which have been a growing concern in recent years. This move not only addresses immediate threats but also sends a message about the U.S. commitment to combating international cybercrime.

Apr 27, 2026

Researchers Identify Fast16 Sabotage Malware That Pre-Dates Stuxnet

Infosecurity Magazine

Researchers have discovered a malware strain called 'fast16' that is believed to have targeted Iran's nuclear program before the well-known Stuxnet attack. This malware predates Stuxnet and indicates that cyber attacks on critical infrastructure may have been more advanced than previously thought. Fast16's potential use against Iran's nuclear facilities raises concerns about the cybersecurity of similar systems worldwide. Understanding this malware could provide insights into the tactics and techniques used by attackers in state-sponsored cyber operations, making it essential for governments and companies to enhance their defenses against such threats.

Apr 27, 2026