The vulnerability involves the Android custom tab feature in Firefox and Firefox Focus, which displayed only the "site" part of the loaded URL rather than the full hostname. This UI limitation could be exploited by hosting malicious content on a subdomain to spoof another subdomain, potentially misleading users about the origin of the content. Mozilla fixed this issue in Firefox 144. The CVSS 3.1 score is 8.1, indicating high severity based on confidentiality and integrity impacts, but Mozilla classifies the impact as low. The vendor advisory confirms the fix in Firefox 144 and provides no indication of active exploitation.

The vulnerability could allow an attacker to spoof the address bar in Android custom tabs, potentially tricking users into trusting malicious content by making it appear as if it originated from a different subdomain. This could lead to user deception and potential phishing attacks. However, the vendor rates the impact as low, and no known exploits have been reported.

This vulnerability is fixed in Firefox 144. Users and administrators should update to Firefox 144 or later to remediate this issue. Since the vendor advisory confirms the fix, no additional mitigation steps are required beyond applying the official update.