Skip to content


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time




This is a demo that allows websites to detect and connect throwaway accounts to their real users when the user is using Firefox's Private Browsing mode. This exploits Firefox's Bug #1100154 that I reported in 2014. Chrome users are not affected by this exploit.

This exploit could be used by sites that allow users to create throwawy or anonymous accounts (Reddit, HackerNews, 4Chan, etc.) to secretly detect a user's real username if that user is using a Firefox Private Browsing window for the throwaway account while keeping their real account open in their main browser session.

##How the exploit works

This exploit works by using with a target window name that exists on the other side of the privacy barrier. If you have a window named "myrealwindow" in your main browser tabs, a link or javascript that targets that name will change the url of that tab, even if the link is across the privacy barrier. See Bug #1100154 for more details.