A crafted URL that includes specific non‑BMP Unicode characters can conceal the true origin of a web page, causing the browser to display a misleading address bar entry. This flaw permits an attacker to spoof the address shown to a user, potentially directing them to a malicious site. The vulnerability is classified as CWE‑290 and CWE‑346, indicating a failure in authentication‑based control and a token validation weakness, respectively, and leads only to deceptive navigation rather than direct code execution or system compromise.

Mozilla Firefox and Mozilla Thunderbird are the documented affected products. Versions before Firefox 137 and before Firefox ESR 128.9, as well as versions before Thunderbird 137 and Thunderbird 128.9, are vulnerable. The CPE list also references Red‑Hat Enterprise Linux components, but the original description does not state that they are impacted; their inclusion appears to reflect support channels for the affected Firefox release streams.

With a CVSS score of 7.3 the vulnerability is high in severity, but the EPSS score of less than 1 % suggests a low likelihood of exploitation. It is not listed in the CISA KEV catalog. An attacker would typically craft a link containing the hidden characters—such as in an email or a web page—and rely on user interaction by clicking the spoofed address. The attack requires no additional credentials and exploits only the rendering of Unicode characters in URLs.