CVE-2025-3859 Firefox Focus elide URL allows address bar spoofing
Attackers can spoof the address bar in Firefox Focus by using long URLs that trigger truncation, misleading users about the current site.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-3859?
CVE-2025-3859 is a medium-severity vulnerability in Mozilla Focus, published on 30 Apr 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Websites directing users to long URLs that caused eliding to occur in the location view could leverage the truncating behavior to potentially trick users into thinking they were on a different webpage. This vulnerability was fixed in Focus 138.
Which versions are affected by CVE-2025-3859?
It affects 1 product.
Products include Mozilla Firefox Focus.
How do I fix CVE-2025-3859?
No fix has been published for CVE-2025-3859 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-3859 being exploited?
There is no known exploitation of CVE-2025-3859 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Focus
Sources
Also known as GHSA-4jh7-c2vv-7qf2.