Cookies that belong to temporary non‑HTML documents created in private tabs were being stored in the same cookie jar that normal browsing uses. As a result, data entered or displayed in those private tabs, such as session tokens or user preferences, could be retrieved after the private tabs were closed. The flaw is a classic sensitive data exposure, identified as CWE‑359, and leads to confidentiality loss of any information that is stored in a cookie during a private session.

Mozilla Firefox for iOS is affected; any installation earlier than version 143.1 contains the bug.

The CVSS score of 4 indicates low severity, and the EPSS score of less than 1 % suggests exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector, inferred from the description, involves an attacker delivering malicious content in a private tab that writes a cookie; when the private tab is closed, that cookie is then visible to the user in a normal browsing session. This risk is limited to users who expose private data to such content and close their private tabs, and no active exploitation has been documented.