1836598 - Firefox for Android Address Bar Spoofing with Long Subdomain

Status: RESOLVED DUPLICATE of bug 1670725

(Fenix :: General, defect)

Description

[Irvan Kurniawan (:sourc7)]

Attachment: Firefox Nightly - MSFT Login + Reader Mode on Pixel_4_API_33.png

On Firefox for Android when I visit URL with long subdomain, I notice the subdomain is shown instead of highlighting the main domain. On Chrome for Android the main domain is highlighted no matter how long the subdomain is.

When showing the subdomain, it possible to spoof the address bar using long subdomain, in example the long spoof subdomain is: login.microsoftonline.com.x300.local, then the address bar will only show login.microsoftonline.com (Tested on Pixel_4_API_33 on default configuration + trigger reader mode icon)

Comment 1

[Irvan Kurniawan (:sourc7)]

Attachment: Screenshot_2023-06-04-06-54-07-029_org.mozilla.fenix.jpg

On my Xiaomi Mi 9T Android 11 on the address bar there are no fade out effect beside the reader icon, so it looks very convincing user is on https://account.microsoftonline.com

Tested on Firefox Nightly 2023-06-03T16:08:16.244921 and Firefox Beta 2023-05-26T05:48:27.374395