Description
A crafted URL using a blob: URI could have hidden the true origin of the page, resulting in a potential spoofing attack. *Note: This issue only affected Android operating systems. Other operating systems are unaffected.* This vulnerability affects Firefox < 141.
Problem types
Address bar spoofing using an blob URI on Firefox for Android
Product status
Credits
Rifa'i Rejal Maynando and Ameen Basha M K
References
bugzilla.mozilla.org/show_bug.cgi?id=1909609
bugzilla.mozilla.org/show_bug.cgi?id=1969937
www.mozilla.org/security/advisories/mfsa2025-56/
