This vulnerability (CVE-2025-27426) affects Firefox for iOS and involves server-side redirects to internal error pages that can cause the browser's address bar to display a spoofed URL. This is classified under CWE-601 (Open Redirect). The flaw allows a malicious site to manipulate the URL shown to the user, potentially facilitating phishing or spoofing attacks. Mozilla addressed this issue in Firefox for iOS 136, as documented in their security advisory MFSA 2025-13. The CVSS 3.1 base score is 5.4, reflecting a network attack vector with low complexity, no privileges required, user interaction needed, and limited confidentiality and integrity impacts.

The vulnerability allows an attacker controlling a malicious website to cause Firefox for iOS to display a spoofed URL by leveraging server-side redirects to internal error pages. This could deceive users into believing they are visiting a legitimate site when they are not, potentially facilitating phishing attacks. The impact is limited to confidentiality and integrity with no availability impact. No known exploits have been reported in the wild.

A fix for this vulnerability is available in Firefox for iOS version 136. Users and administrators should update to this version or later to remediate the issue. The vendor advisory does not indicate any additional mitigation steps are necessary beyond applying the update.