1670725 - (CVE-2025-8041) (urlbar-truncate-android) Truncate URL bar from the front, preserve the important parts of the domain

Status: RESOLVED FIXED

(Firefox for Android :: Toolbar, defect, P3)

Description

[Kirtikumar Anandrao Ramchandani]

Assigned to:- Firefox
Assigned by:- Kirtikumar Anandrao Ramchandani
Assigned on:- 11/10/2020
Vulnerability Name:- Hostname not elided securely (URL Spoofing on Android browser).
Vulnerability Details:- The browser shown the first past instead of the hostname.
Platform:- Android
Application Version:-

1. Firefox Browser 81.1.4
2. Firefox Lite 2.5.2
3. Firefox Browser Beta 82.0.0-beta.4
4. Firefox Focus 8.8.1
5. Firefox Nightly 201010 17:10
   Device:- Xiaomi Redmi Note 5 Pro (Android 9) (Build/PKQ1.180904.001)
   Video Proof of concept:- https://drive.google.com/file/d/1QOSJyQWM6DIVFgPXHHn1Nd9ynJ6WoMjz/view?usp=sharing
   Original PoC uploaded on:- https://kirtikumarar.com/Firefox_PoC.html
   The result observed:- http://wwww.manage-myaccount.paypal.com....
   Result Expected:- http://....bntk.pl

Steps to reproduce:-

1. Load the Website or the attached testcase.
2. Click on "Click here to go to Google.com"
3. Go back to the parent tab and observe the URL in the address bar.

Comment 1

[Kevin Brosnan [Ex-Mozilla]]

I don't see what the popup does here. It does not seem particularly important to this. This seems like a variant of https://github.com/mozilla-mobile/fenix/issues/6762 and that the parts of the domain that Firefox chooses to display could be improved.

Comment 2

[Daniel Veditz [:dveditz]]

This is a regression from Fennec - I'm pretty sure there much be a dupe (in addition to Chris's github issue)

Comment 3

[Amedyne Moya [:amoya]]

Petru, Can you investigate this one, and check if the github issue mentioned by kevin is related to this. Thanks!

Comment 4

[Kevin Brosnan [Ex-Mozilla]]

The ideal solution here is for GV to fix bug 1685152 and then port the Fennec or Desktop URL parsing code to Fenix/AC.

Comment 5

[Petru-Mugurel Lingurar [:petru]]

Seems like the issue Kevin posted would indeed resolve this and was something that Sebastian & Kate wanted to tackle.
If they don't have cyles to work on this now I'll look into it.
Keeping a NI here to know to follow this.

Comment 6

[Petru-Mugurel Lingurar [:petru]]

Agi's newly opened ticket would probably help with this.
Thank you Kevin!
Adding him to this ticket also.

Comment 7

[Kirtikumar Anandrao Ramchandani]

Happy new year!
Opera has fixed the same issue in Opera Mini (Android). Here: https://twitter.com/Kirtikumar_A_R/status/1348569263548755971

Comment 8

[Daniel Veditz [:dveditz]]

Unfortunately this issue was already known to us (see the linked github issue) and is not eligible for a bug bounty.

Comment 9

[Kirtikumar Anandrao Ramchandani]

This issue will atleast receive CVE, yes? Issue where it shows LTR instead of RTL. Thanks!

Comment 10

[Daniel Veditz [:dveditz]]

I don't know how advisories and CVEs are handled for Firefox Lite.

Comment 11

[Kirtikumar Anandrao Ramchandani]

Can you add somebody in the CC who can assign a CVE?

Comment 12

[Petru-Mugurel Lingurar [:petru]]

Removing my NI while we wait for https://bugzilla.mozilla.org/show_bug.cgi?id=1685152

Comment 13

[Chris Peterson [:cpeterson]]

GV would expose Gecko's URI API (bug 1685152) to Fenix frontend.

Comment 15

[Daniel Veditz [:dveditz]]

(Sorry, duping was a mistake. Fenix has completely independent addressbar code from Desktop)

Comment 20

[Chris Peterson [:cpeterson]]

See also RTL bug 1427647

Comment 23

[Chris Peterson [:cpeterson]]

Group: mobile-core-security
Status: NEW → RESOLVED
Duplicate of bug: 1598175
Resolution: --- → DUPLICATE

Marking this bug as a private security bug again. Looks like the security flag was cleared when this bug was mistakenly resolved as a duplicate of a desktop address bar bug.

This bug will get fixed by Android's toolbar redesign project (phase 2).

Comment 27

[Daniel Veditz [:dveditz]]

Making public again because the Fenix GH issue is public and the https://long-extended-subdomain-name-containing-many-letters-and-dashes.badssl.com/ test site is a well-known demonstration of exactly this bug.

Comment 29

[Petru-Mugurel Lingurar [:petru]]

Adding a note that the behaviour for how URLs will be displayed on Android will change after bug 1812898, with the domain being bolded and the entire URL scrolled to focus on the domain.

Comment 30

[Petru-Mugurel Lingurar [:petru]]

@Daniel Since we're working on toolbar updates - bug 1812898 - and other work planned to start soon and we just modified how we show the URL in Android could you add me on 1909609? I'm curios what's the relation between these two tickets and whether we can help with anything - or at least not break anything.

Comment 31

[Daniel Veditz [:dveditz]]

Will bug 1812898 be sufficient to fix this bug? They sound like the same thing really.

Comment 32

[Michel Le Bihan]

It looks like the same bug to me.

Also, what is the referenced bug 1909609 about?

Comment 33

[Petru-Mugurel Lingurar [:petru]]

Agree that bug 1812898 can be considered to have fixed this issue also.
And also bug 1909609 which is similar to this.
Thank you Michel!

Comment 34

[Michel Le Bihan]

Why is access to bug 1909609 restricted? Can it be made public?

Comment 35

[Petru-Mugurel Lingurar [:petru]]

These are questions for Daniel.

Comment 36

[Gian-Carlo Pascutto [:gcp]]

Why is access to bug 1909609 restricted? Can it be made public?

That bug seems to describe an additional trick that's not described in the public GV issue. It's marked to be automatically opened up as the release with the fix rolls out.

Comment 37

[Daniel Veditz [:dveditz]]

Why is access to bug 1909609 restricted? Can it be made public?

What :gcp said about the other bug, except that our usual process doesn't unhide bugs until several weeks after a release because of the long tail of slow updaters. But we're looking at bug 1909609 to see if it calls for manual intervention

Comment 41

[Simon Friedberger [:simonf]]

Attachment: advisory.txt

Comment 42

[Simon Friedberger [:simonf]]

Attachment: advisory.txt

Comment 43

[Simon Friedberger [:simonf]]

Attachment: advisory.txt