When a network error occurred during page load, the prior content could have remained in view with a blank URL bar. This could have been used to obfuscate a spoofed web site. This vulnerability affects Firefox < 126.
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Link | Tags |
---|---|
https://bugzilla.mozilla.org/show_bug.cgi?id=1875248 | issue tracking |
https://www.mozilla.org/security/advisories/mfsa2024-21/ | vendor advisory |