1912709 - (CVE-2025-0246) Android Firefox Nightly Address bar Spoof with SSL Lock via navigation to non-existent protocol

Status: RESOLVED FIXED

(Firefox for Android :: Toolbar, defect, P3)

Description

[James Lee]

Attachment: Screen_Recording_20240812_151614_Firefox Nightly.mp4

I stumbled upon a strange behaviour when I tried to navigate to "nttps://google.com" where nttps is non-existent protocol, from https://google.com where address bar will point to nttps://google.com but we're still on same https://google.com page.

This means that we're able to spoof address bar via navigation like typing in nttps://google.com or copy and navigate via clipboard, or with bookmark.

I'm pretty sure there is better character than "n" to make this spoof better, but you get the idea of how this could be abused for spoofing attack.

PoC demo: https://pwning.geniuscoolcat.com/nttps.php

Comment 1

[James Lee]

I believe this is sec-moderate like https://bugzilla.mozilla.org/show_bug.cgi?id=1681103 since it's a spoof with SSL Lock based on Copy/Paste and this one acrually works with popped-up bookmark navigation too.

Comment 2

[Daniel Veditz [:dveditz] back January 5, 2026]

This appears to be fixed in 134 (beta) but we don't know what fixed it. There were some general toolbar redesign work but I don't know if that touched the address parsing part

Comment 3

[Frederik Braun [:freddy]]

Attachment: advisory.txt

Comment 4

[James Lee]

Hi Dan, thank you for the confirmation and thank you for the update, Frederik.

Just for the note, this could've been abused via some trusted existing protocols too, such as "ssh://google.com", "ftp://google.com" etc.

Comment 5

[Frederik Braun [:freddy]]

The browser will treat ssh:// and foobar:// both as invalid. Happy to change that to "unhandled" if you feel strongly.

Comment 6

[James Lee]

Thank you for the reply and suggestion Frederik, the intention of above reply wasn't for suggesting advisory context change btw (I do agree that both "invalid" and "unhandled" would be appropriate for the description). I just wanted to add info for the context of this issue here that other existing protocols like above could've also been abused for this issue.

Comment 7

[James Lee]

bug 1907229 and bug 1907232 were also fixed in 134 after the Toolbar change.