# Firefox identifier linking all your private Tor identities

**URL:** https://teo9i.com/t/firefox-identifier-linking-all-your-private-tor-identities/8330
**Category:** Science & Technology
**Tags:** security, firefox
**Created:** [April 22, 2026, 6:02pm UTC](https://teo9i.com/t/firefox-identifier-linking-all-your-private-tor-identities/8330 "2026-04-22T18:02:48Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![REALITY](https://teo9i.com/user_avatar/teo9i.com/reality/32/25124_2.png) [@REALITY](https://teo9i.com/u/REALITY)
#### Post date: [April 22, 2026, 6:02pm UTC](https://teo9i.com/t/firefox-identifier-linking-all-your-private-tor-identities/8330/1 "2026-04-22T18:02:49Z")

</div>

# We found a stable Firefox identifier linking all your private Tor identities

 ![blog_firefox_vulnerability](https://teo9i.com/uploads/default/original/3X/f/0/f0965ec8efa98151a960c5edaa3a74c887391957.jpeg)  
We recently discovered a privacy vulnerability affecting all Firefox-based browsers. The issue allows websites to derive a unique, deterministic, and stable process-lifetime identifier from the order of entries returned by IndexedDB, even in contexts where users expect stronger isolation.

This means a website can create a set of IndexedDB databases, inspect the returned ordering, and use that ordering as a fingerprint for the running browser process. Because the behavior is process-scoped rather than origin-scoped, unrelated websites can independently observe the same identifier and [link activity across origins](https://fingerprint.com/blog/external-protocol-flooding/) during the same browser runtime. In [Firefox Private Browsing mode](https://fingerprint.com/blog/firefox-privacy-security-guide/), the identifier can also persist after all private windows are closed, as long as the Firefox process remains running. In Tor Browser, the stable identifier persists even through the [“New Identity”](https://support.torproject.org/tor-browser/features/managing-identities/) feature, which is designed to be a full reset that clears cookies and browser history and uses new Tor circuits. The feature is described as being for users who “want to prevent [their] subsequent browser activity from being linkable to what [they] were doing before.” This vulnerability effectively defeats the isolation guarantees users rely on for unlinkability…

> **[We Found a Stable Firefox Identifier Linking All Your Private Tor Identities](https://fingerprint.com/blog/firefox-tor-indexeddb-privacy-vulnerability/)**
>
> We discovered a privacy vulnerability in Firefox Private Browsing and Tor Browser that allows websites to fingerprint and track users across origins using IndexedDB database ordering, even after closing all private windows.