Firefox IndexedDB Vulnerability Breaks Tor Browser Anonymity Across New Identity Resets

Analysis
The vulnerability was deterministic, process-lifetime persistent, and survived New Identity resets, making it operationally ideal for sustained deanonymization by an intelligence service or law enforcement. Pre-patch exploitation is very unlikely to surface within the next six months, a judgment the analytic ensemble revised sharply from genuinely uncertain. The dominant driver is base rate: exploitation disclosure historically depends on contingent events such as unsealed court filings, vendor capability leaks, or Tor Project advisories, and the observed frequency of such disclosure within six months of a patch is low. That no prior privacy audit flagged the entry-ordering identifier suggests the inventory of Tor deanonymization primitives available to capable actors is broader than the public disclosure pipeline reveals.