This vulnerability involves the handling of long hostnames in URLs within Firefox for iOS, which could be exploited to obscure or spoof the displayed website address in the browser's address bar. The flaw is categorized under CWE-346 (Origin Validation Error). It was reported by Khalil Zhani and fixed in Firefox for iOS 134. The CVSS v3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. The vendor advisory confirms the fix and provides additional context on the issue.

The vulnerability allows an attacker to spoof the website address displayed in the Firefox for iOS address bar by leveraging long hostnames, potentially misleading users into trusting malicious sites. There is no direct confidentiality or availability impact, but the integrity of the displayed URL is compromised, which could facilitate phishing or social engineering attacks.

This vulnerability is fixed in Firefox for iOS version 134. Users and administrators should ensure that Firefox for iOS is updated to version 134 or later to mitigate this issue. No additional mitigation steps are required as the vendor has provided an official fix.