1959105 - [Android] Firefox Url Bar Spoof - Long Domain

Status: RESOLVED DUPLICATE of bug 1670725

(Firefox for Android :: General, defect)

Description

[Ameen Basha M K]

Attachment: [Android] Firefox - LongDomain - URL Spoof.mp4

Hi Team, Firefox Nightly latest on android is vulnerable for an url bar spoof vulnerability which allows the attacker to trick the victim thinking of they are in legit website and sharing the credit but which is not.

Have tested it on latest firefox nightly on today in android 12

Steps to reproduce

1. open the html and click the click_here
2. you can see the paypal.com in the url bar instead fakesite

Have tested the same in chrome, it is not vulnerable

i have attached the poc video and html for reference

Comment 1

[Ameen Basha M K]

Attachment: demo1.html

Comment 2

[Ameen Basha M K]

Attachment: test.html

Comment 4

[Ameen Basha M K]

Issue applies for ios too, the duplicate issue was opened for long time and also it is for android.

I have confirmed the same in ios, hope it is a different platform and will be handled differently

Kindly check for reopen it for ios

Comment 5

[Andrew McCreight [:mccr8]]

We also have this bug already filed for iOS (bug 1904968) and desktop (bug 1598175), sorry.

Comment 6

[Ameen Basha M K]

Thanks for the update andrew