The vulnerability limits the information shown in the Firefox and Firefox Focus user interface for Android custom tabs to only the site name, omitting the full hostname. Content served from a subdomain of a legitimate site could therefore appear to come from a different subdomain, potentially misleading a user about the origin of the content. This deceptive display may allow a malicious party to trick a user into accepting or interacting with content that it believes is from a trusted domain.

Mozilla’s Firefox and Firefox Focus browsers running on Android devices are affected. The flaw exists in all releases prior to Firefox 144. Devices with older versions of these browsers are vulnerable to the spoofing risk described.

The CVSS score of 8.1 reflects a high severity, while the EPSS score of less than 1% indicates that the likelihood of exploitation is low but not negligible. This vulnerability is not listed in the CISA KEV catalog, so no widespread exploitation campaigns are documented. Based on the description, it is inferred that the likely attack vector involves an application that opens a custom tab to a malicious subdomain; the attacker leverages the limited hostname display to deceive the user without needing code execution or elevated privileges. The risk remains significant because users may trust the displayed site name and interact with dangerous content.