2055386 - Omnibox Spoofing via Domain Truncation at reduced window width (desktop version)

Status: RESOLVED DUPLICATE of bug 1598175

(Firefox :: Address Bar, defect)

Description

[Santiko Kusnul Hakim]

Attachment: firefox-omnibox-spoofing-via-split-screen-mode.mp4

DESCRIPTION

A vulnerability exists in the Firefox browser's Split Screen mode that can allow a malicious website to spoof its origin in the address bar (omnibox). When the browser window is split horizontally or vertically, the address bar area is significantly narrowed, causing the full URL to be truncated .

The issue occurs when a user navigates to a URL containing an excessively long subdomain, such as:

https://long-extended-subdomain-name-containing-many-letters-and-dashes.badssl.com/

When rendered in a split-screen configuration, the omnibox truncates the displayed text by prioritizing the beginning of the URL—the long subdomain, while the true origin (badssl.com) becomes hidden from view. This is a visual truncation issue, a specific type of UI Misrepresentation of Critical Information (CWE-451).

STEPS TO REPRODUCE

1. Open the Firefox for PC browser.
2. Enable Split Screen mode by splitting the window vertically or horizontally .
3. In one of the split panels, navigate to: https://long-extended-subdomain-name-containing-many-letters-and-dashes.badssl.com/.
4. Observe the address bar; the subdomain is displayed, but the true destination origin (badssl.com) is hidden from view due to truncation (see attached screenshot).

ROOT CAUSE

The root cause lies in the interaction between two browser features:

1. Firefox's Split Screen Mode significantly reduces the available width for the address bar .
2. The browser's URL display logic does not properly prioritize the registrable domain (badssl.com) when truncating long URLs. Instead, it truncates from the end, allowing a maliciously crafted long subdomain to push the true origin out of the visible area.

Firefox has been actively developing and refining its Split Screen functionality, with recent updates focusing on reliability and introducing a "unified address bar" with "domain chips" . This vulnerability appears to be a UI rendering edge case introduced by the narrowed address bar in split-screen layouts. A similar issue was previously fixed to prevent address bar buttons from being cut off when the window width was too low .

ACTUAL BEHAVIOUR

1. In the omnibox appears: long-extended-subdomain-name-containing-many-letters-and-dashes.bad
2. Main domain badssl.com half-hidden

EXPECTED BEHAVIOUR

1. This should be: g-extended-subdomain-name-containing-many-letters-and-dashes.badssl.com
2. The main domain must be appeared.

RESOLUTION

The following remediation steps are recommended:

1. Update the URL display logic in Split Screen mode to ensure the registrable domain (e.g., badssl.com) is always visible, regardless of the subdomain length. When space is limited, the middle of the URL should be truncated, preserving both the protocol/subdomain and the critical domain name.
2. Audit the unified address bar implementation in Split Screen mode to ensure critical security indicators are never hidden due to space constraints .
3. Ensure the fix works for all supported split-screen layouts, including vertical, horizontal, and grid configurations .

Comment 1

[Marco Bonardo [:mak] (Away 10-21 August)]

Which version of Firefox was this tested on?
I think it's fixed in 153, and likely just a dupe of bug 1598175.
The split screen is an unnecessary detail, any way to make the window smaller would have similar issues.