The Address Bar component in Firefox Focus for Android can display an incorrect or misleading URL, potentially leading users to believe they are on a legitimate site when they are not. This spoofing can undermine user trust and enable phishing or social‑engineering attacks, as the user may interact with malicious content based on the falsified address. The vulnerability has been fixed in Firefox 142, so versions prior to that may exhibit the flaw.

Mozilla’s Firefox Focus for Android; specifically any installation running Firefox Focus version 141 or earlier, until the application is updated to version 142 or later.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. The most plausible attack scenario involves malicious web content or compromised network traffic that triggers the address bar to incorrectly display the URL; this inference is drawn from the description of a spoofing issue in the editor component. Attackers would need to embed deceptive content within the browser session to exploit the flaw, making it a local or application‑level vector rather than a remote host attack.