CVE-2025-8043

The vulnerability (CWE-451 — User Interface Misrepresentation of Critical Information) occurs because when a URL is too long to fit in the address bar, the Focus mechanism truncated it from the beginning of the string instead of preserving and exposing the part containing the origin (domain). As a result, the user sees a URL fragment that does not reflect the actual server domain, which can be exploited by an attacker to conduct a spoofing attack — the victim believes they are on a trusted site when they are actually on a domain controlled by the attacker.

An attacker can trick a user into believing they are visiting a trusted website, which opens the door to credential theft (phishing) or other identity spoofing attacks.

Mozilla Firefox should be updated to version 141 or newer. For Mozilla Thunderbird, patches available from the vendor should be applied according to the references (https://www.mozilla.org/security/advisories/mfsa2025-56/)

Mozilla Firefox in versions prior to 141; according to the description, the vulnerability also affects Mozilla Thunderbird — specific versions indicated in the vendor's references