The vulnerability is an open redirect flaw that allows a website to redirect a user to a URL using a non-http scheme, such as a custom scheme or app-specific URL. This can cause the address bar to display a legitimate domain while the user is actually navigated to a malicious page or application, creating a high risk of phishing or credential theft. The weakness is classified as CWE-601, which indicates that an attacker can redirect a user to an arbitrary external site or scheme without validation.

Mozilla Firefox for iOS is affected when it runs on versions released before 136. The fix was implemented in Firefox for iOS 136, so any earlier release exposes users to this address bar spoofing risk on iOS devices.

The CVSS score of 4.3 categorizes the vulnerability as low severity, and the EPSS score of less than 1% indicates a very low probability of exploitation under current conditions. The vulnerability is not listed in the CISA KEV catalog. An attacker would need only to craft a malicious link that triggers a server‑side redirect to a non-http scheme, which is feasible through a regular web page or email, and requires the victim to interact with the redirect. No elevated privileges or additional exploits are needed for the attack to succeed.