VulnerabilityPublished 2 Jun 2023Updated 27 May 2025

CVE-2023-32212: Mozilla Firefox · Potential spoof due to obscured address bar

Affects Mozilla FirefoxSource CVE Database V5

Not known to be exploited : upgrade to 113 or 102.11 soon.

Data as of 26 Oct 2026, 17:16 UTC

Severity

High

Rated High by the CNA (mozilla) · No CVSS score from NVD or the CNA

EPSS: 0.6% chance of exploitation in 30 days – higher than 50% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 113, 102.11

Exploitation evidence

Disclosed: evidence found.
CVE published 2 Jun 2023
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Mozilla Firefox to 113 or 102.11.

Affected software

Product	Affected	Fixed in
Mozilla Firefox	Affected <113 <102.11	Fixed in 113 102.11

AI-suggested

European organizations should implement a multi-layered approach to mitigate this vulnerability. First and foremost, they should ensure that all Firefox and Thunderbird installations are updated to versions 113 and 102.11 respectively or later, where the vulnerability is addressed. If you cannot patch yet, organizations should educate users about the risks of UI spoofing and encourage vigilance when verifying URLs, especially when prompted for credentials. Deploying endpoint protection solutions that can detect phishing attempts and malicious web content can provide an additional security layer. Network-level defenses such as web filtering and DNS security can block access to known malicious sites. Organizations should also consider implementing multi-factor authentication (MFA) to reduce the impact of credential theft. Security awareness training should emphasize the importance of scrutinizing browser UI elements and reporting suspicious activity. Finally, IT teams should monitor threat intelligence feeds for any emerging exploits related to this vulnerability and be prepared to respond promptly.

Description

An attacker could have positioned a `datalist` element to obscure the address bar. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.

Impact

For European organizations, this vulnerability poses a significant risk primarily through phishing and social engineering attacks. If exploited, attackers could deceive employees or customers by presenting fake URLs that appear legitimate, potentially leading to credential compromise, unauthorized access to sensitive systems, or data breaches. Organizations in sectors such as finance, healthcare, government, and critical infrastructure are particularly at risk due to the high value of their data and the potential for reputational damage. The impact extends to both confidentiality and integrity, as attackers could harvest login credentials or inject malicious content under the guise of trusted sites. Although the vulnerability does not directly affect system availability, the downstream effects of successful phishing campaigns could include ransomware infections or other disruptive attacks. Given the widespread use of Firefox and Thunderbird in Europe, especially in enterprises and public institutions valuing open-source software, the threat surface is considerable. The absence of known exploits in the wild reduces immediate risk but does not eliminate the potential for future attacks, emphasizing the need for proactive mitigation.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Jul 2025, 03:10 UTC

Technical details

References

Community reviews

Related threats