Closed
Bug 1860399
Opened 3 years ago
Closed 3 years ago
(Firefox Android) Url with long name in url bar ,Not displaying the original domain in the url bar leads to spoof
Categories
(Firefox for Android :: General, defect, P3)
Firefox for Android
General
Tracking
()
RESOLVED
DUPLICATE
of bug 1670725
People
(Reporter: sas.kunz, Unassigned)
Details
(Keywords: reporter-external, Whiteboard: [reporter-external] [client-bounty-form] [verif?])
Attachments
(2 files)
msg183539871-50549.jpg
i found vulnerability on firefox android where Url addrees with long name on the url bar not displaying the original domain lead to spoof
step to reproduces
- create subdomain : (for example : loginss.accounts.google.com.mozilla.org
- open http://103.186.0.20/spoofingbarfirefox.html
- click on "LOGIN TO GOOGLE" link then on the url address bar only show https://loginss.accounts.google.com
Flags: sec-bounty?
|
||
Updated•3 years ago
|
Group: firefox-core-security → mobile-core-security
Component: Security → General
Product: Firefox → Fenix
|
||
Updated•3 years ago
|
Flags: needinfo?(dveditz)
|
||
Comment 2•3 years ago
|
||
Bug 1629684 is a similar desktop. It's P3/S3 and has a sec-low rating.
Should we align the domain name in the address bar so the TLD is always visible?
Severity: -- → S3
Priority: -- → P3
|
|
||
Updated•3 years ago
|
Group: mobile-core-security
Status: NEW → RESOLVED
Closed: 3 years ago
Duplicate of bug: CVE-2025-8041
Flags: needinfo?(dveditz)
Resolution: --- → DUPLICATE
|
|
||
Updated•2 years ago
|
Flags: sec-bounty? → sec-bounty-
|
||
Updated•2 years ago
|
Keywords: reporter-external
You need to log in
before you can comment on or make changes to this bug.
Description
•