1972097 - URL Spoofing Still Occurs on Firefox Focus Android on Several Android Versions (14 and 13) Despite Being Marked Fixed

Status: RESOLVED DUPLICATE of bug 1970209

(Focus :: General, defect)

Description

[alayershunters]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Steps to reproduce:

Bug Description:

I would like to report that the URL spoofing issue on the address bar still persists in Firefox Focus for Android on several devices running certain Android versions, even though it has been previously marked as fixed.

Steps to reproduce:

Open Firefox Focus on an Android device.

Visit the following URL:
https://long-extended-subdomain-name-containing-many-letters-and-dashes.badssl.com

Observe the URL displayed in the address bar.

Actual results:

Actual result:
The address bar does not display the main domain badssl.com. Only the initial part of the very long subdomain is shown, which can cause spoofing and mislead users.

Expected results:

Expected result:
The browser should clearly display the main domain (badssl.com) without confusion, even if the subdomain is very long.

---

Affected Devices and Android Versions:

• Oppo Reno 7 – Android 14
• Oppo Reno 8 – Android 14
• Samsung Galaxy – Android 13

---

Additional Information:

This bug was previously reported and marked as fixed by QA (Mira Lobontiu) in:
https://bugzilla.mozilla.org/show_bug.cgi?id=1970209

QA tested the fix on Firefox Focus Nightly 141.0a1 (released June 12) using Google Pixel 6 and Oppo Find N2 Flip devices running Android 15.

However, the spoofing issue still occurs on the lower Android versions listed above.

For comparison, a similar issue was reported in Chromium (https://issues.chromium.org/issues/395544225) which was given a high priority (P1, S2) and awarded a bounty of $3000. Nevertheless, even after the fix, when tested on Samsung S24 Ultra using Custom Tabs, the spoofing issue persists where the main domain does not show in the address bar, potentially confusing users.

---

Request:

I hope this report can be taken into consideration, and that I may qualify for a bounty on this finding since the bug remains present on Android versions not covered in the initial QA testing.

Comment 1

[alayershunters]

POC VIDEOS

https://drive.google.com/drive/folders/1bqBrpt55m-fRqJSIj1n_P9hrowXlolsk?usp=drive_link

Comment 2

[alayershunters]

Attachment: opporeno8.png

Comment 3

[alayershunters]

Attachment: samsungandroid13.png

Comment 4

[alayershunters]

Attachment: oppo reno 7 android 14.png

Comment 5

[Andrew McCreight [:mccr8]]

Your video shows that you were testing Firefox 139. Bug 1970209 is only fixed in Firefox 141, so it is expected that it isn't fixed in 139.