The Firefox and Firefox Focus UI for the Android custom tab feature only showed the site that was loaded, not the full hostname. User supplied content hosted on a subdomain of a site could have been used to fool a user into thinking it was content from a different subdomain of that site. This vulnerability affects Firefox < 144.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Mozjs102 | Ubuntu | esm-apps/noble | * |
| Mozjs102 | Ubuntu | jammy | * |
| Mozjs102 | Ubuntu | noble | * |
| Mozjs115 | Ubuntu | noble | * |
| Mozjs115 | Ubuntu | plucky | * |
| Mozjs52 | Ubuntu | esm-apps/focal | * |
| Mozjs52 | Ubuntu | esm-infra/bionic | * |
| Mozjs68 | Ubuntu | esm-infra/focal | * |
| Mozjs78 | Ubuntu | esm-apps/jammy | * |
| Mozjs78 | Ubuntu | jammy | * |
| Mozjs91 | Ubuntu | jammy | * |