Site attribute spoofing on Android by pasting URL with unknown scheme

Site attribute spoofing on Android by pasting URL with unknown scheme

Announced

September 22, 2015

Reporter

Jordi Chancel

Impact

Moderate

Products

Firefox

Fixed in

• Firefox 41

Description

Security researcher Jordi Chancel reported that on Firefox for Android, when a URL is pasted with an unknown protocol, such as secure: or httpz:, the pasted URL is shown in the addressbar but no navigation occurs. Other addressbar attributes present before this pasted URL is entered will continue to be rendered. This could lead to potential spoofing by a malicious site.

This issue only affects Firefox for Android and does not affect Firefox on OS X, Linux, or Windows operating systems.

References

• Custom URI schemes in the location bar can lead to URL & SSL spoofing (CVE-2015-4476)