A spoofing issue has been identified in the Address Bar component of Firefox Focus for Android, affecting versions prior to 142. This vulnerability allows attackers to manipulate the address bar, potentially misleading users about the authenticity of the website they are visiting. Users are advised to update their browsers to mitigate this risk.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.5 | CVE-2025-9186 |
Exploitation
To exploit this vulnerability, an attacker could craft a malicious link that, when clicked by a user, would lead them to a deceptive website. The attacker would need to ensure that the user interacts with the link, as user interaction is required for the spoofing to take effect. This could be done through social engineering tactics to convince the user to click on the link.
Affected Products
- Firefox Focus for Android: A privacy-focused browser that allows users to browse the web without being tracked. This version is vulnerable if it is below version 142.
Mitigation
To mitigate this vulnerability, users should update their Firefox Focus for Android to the latest version available. Regularly checking for updates and applying them promptly can help protect against known vulnerabilities and enhance overall security.