Mozilla Firefox and Firefox Focus Spoofing Vulnerability in Android Custom Tabs

A spoofing vulnerability has been identified in the Firefox and Firefox Focus browsers for Android, specifically within the custom tab feature. The issue arises because the UI only displays the 'site' that is loaded, rather than the full hostname. This limitation could be exploited by user-supplied content hosted on a subdomain, potentially misleading users into believing it was content from a different subdomain of the same site. The vulnerability affects Firefox versions prior to 144.

Impact

Exploitation of this vulnerability could lead to user deception regarding the origin of content displayed in custom tabs, creating a risk of phishing or similar attacks.

Remediation

Users can upgrade to Firefox 144 or later to address this vulnerability.