A crafted URL using a blob: URI could have hidden the true origin of the page, resulting in a potential spoofing attack. This issue only affected Android operating systems, while other operating systems remain unaffected. The vulnerability impacts Firefox versions below 141.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.3 | CVE-2025-8364 |
Exploitation
To exploit this vulnerability, an attacker could craft a malicious URL using a blob: URI that disguises the true origin of the page. By tricking users into clicking on this link, the attacker could potentially lead them to a spoofed site, thereby compromising user trust and security.
Affected Products
- Firefox versions < 141 on Android: This version is vulnerable to spoofing attacks via crafted blob: URIs.
Mitigation
To mitigate this vulnerability, users should ensure they are using the latest version of Firefox on their Android devices. Regular updates will help protect against known vulnerabilities and enhance overall security.