Mozilla’s browsers incorrectly truncate URLs toward the beginning instead of around the origin. This causes the address shown to omit the true destination and instead display a benign prefix, potentially confusing users about the site they are viewing. The flaw is classified as CWE‑451, improper handling of output visible to users, and can undermine user confidence in the browser’s address bar.

The vulnerability affects Mozilla Firefox; all releases prior to version 141 are vulnerable, with the fix applied in Firefox 141. The Common Platform Enumeration list also includes Thunderbird, but no specific patch version is documented, so older Thunderbird releases remain at potential risk until an update is released.

The CVSS score of 9.8 indicates a high severity. The EPSS score of less than 1% implies that exploitation is currently rare, and the flaw is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is through the browser UI: an attacker can craft a link that displays a harmless prefix while the actual destination is malicious, potentially enabling social engineering or deceptive browsing experiences.