Vulnerability · Published Jan 11, 2025 · Assigned by mozilla
CVE-2025-23109Address bar spoofing on iOS using long hostnames
Medium 6.5
In plain English
A medium-severity security flaw in Firefox for iOS from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.2%top 91.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Long hostnames in URLs could be leveraged to obscure the actual host of the website or spoof the website address. This vulnerability was fixed in Firefox for iOS 134.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox for iOS | see references |
Weakness: CWE-346 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N