Mozilla Firefox for iOS allows long hostnames in URLs to be displayed in a way that hides the true host, potentially misleading users about the site they are visiting. Based on the description, the vulnerability could be exploited to facilitate phishing or social‑engineering attacks that rely on a user's trust in the displayed address. It is an input manipulation flaw (CWE‑346) that does not give direct access or code execution but undermines user confidence and could, if a user is tricked into submitting information on a forged address, lead to credential compromise.

Firefox for iOS versions prior to 134 are affected. The vulnerability was addressed in Firefox for iOS 134, so all earlier builds of Firefox for iOS should be considered at risk.

The CVSS score of 6.5 indicates a medium severity flaw. The EPSS score of less than 1% suggests a low probability of exploitation at this time. The issue is not listed in the CISA KEV catalog. Based on the description, the likely exploitation scenario would involve a malicious site with a very long hostname designed to mislead the address bar display; the attacker would need users to visit such a site, but no further privileges or payloads are required.