CVE-2025-23109

Address bar spoofing on iOS using long hostnames

CVSS 6.5 MEDIUMEPSS 0.2%CWE-346

Long hostnames in URLs could be leveraged to obscure the actual host of the website or spoof the website address. This vulnerability was fixed in Firefox for iOS 134.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected products

Mozilla · Firefox for iOS

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1419275 https://www.mozilla.org/security/advisories/mfsa2025-06/