CVE-2023-4052: Mozilla Firefox

Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days.

The Firefox updater created a directory writable by non-privileged users. When uninstalling Firefox, any files in that directory would be recursively deleted with the permissions of the uninstalling user account. This could be combined with creation of a junction (a form of symbolic link) to allow arbitrary file deletion controlled by the non-privileged user. *This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 116, Firefox ESR < 115.1, and Thunderbird < 115.1.

Affected products

• Mozilla Firefox: before 116.0 (fixed in 116.0)
• Mozilla Firefox ESR: before 115.1 (fixed in 115.1)

Published 2023-08-01. Last modified 2026-06-17.