CVE-2025-23109
Address bar spoofing on iOS using long hostnames
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 6.5EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
11 Jan 2025Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
Long hostnames in URLs could be leveraged to obscure the actual host of the website or spoof the website address. This vulnerability was fixed in Firefox for iOS 134.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected products
Mozilla · Firefox for iOSWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →