CVE-2025-3859

MEDIUM

Mozilla Firefox Focus < 138.0 - User Interface Misrepresentation via URL Eliding

Title source: llm

Description

Websites directing users to long URLs that caused eliding to occur in the location view could leverage the truncating behavior to potentially trick users into thinking they were on a different webpage. This vulnerability was fixed in Focus 138.

References (2)

Core 2

Core References

Issue Tracking

https://bugzilla.mozilla.org/show_bug.cgi?id=1951533

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2025-33/

Scores

CVSS v3 6.1

EPSS 0.0017

EPSS Percentile 6.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-451 CWE-601

Status published

Products (2)

mozilla/firefox_focus < 138.0

Mozilla/Focus 138

Published Apr 30, 2025

Tracked Since Feb 18, 2026