This vulnerability in Firefox on Android allows a malicious page to spoof the browser's address bar by creating a fake address bar when the real one is hidden due to scrolling, exploiting the visibilitychange event. This could deceive users into trusting a malicious site by displaying a counterfeit URL bar. The issue is tracked as CVE-2025-11718 and was resolved in Firefox 144. The fix was included in a comprehensive security advisory (MFSA 2025-81) that addressed multiple vulnerabilities, including several high-impact memory safety bugs and other moderate-impact issues.

The impact of this vulnerability is moderate, as it enables UI spoofing that could trick users into believing they are visiting a legitimate website when they are not. This could facilitate phishing or social engineering attacks. There is no indication of direct code execution or data compromise from this vulnerability alone. No known exploits in the wild have been reported.

Mozilla fixed this vulnerability in Firefox 144. Users and administrators should update to Firefox 144 or later to remediate this issue. Since the vendor advisory confirms the fix is available and deployed, no additional mitigation steps are required beyond applying the official update.