CVE-2025-3859
Firefox Focus elide URL allows address bar spoofing
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 4.3EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
30 Apr 2025Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
Websites directing users to long URLs that caused eliding to occur in the location view could leverage the truncating behavior to potentially trick users into thinking they were on a different webpage. This vulnerability was fixed in Focus 138.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Affected products
Mozilla · FocusWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →