This vulnerability involves URL bar spoofing via non-BMP Unicode characters in Mozilla Firefox. A specially crafted URL can use certain Unicode characters to hide the true origin of a webpage, potentially misleading users about the legitimacy of the site they are visiting. This flaw was identified and reported by Renwa Hiwa and fixed in Firefox 137 and Firefox ESR 128.9. The CVSS 3.1 base score is 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability at a low level. The vendor advisory confirms the fix and recommends updating to the patched versions.

The vulnerability could allow an attacker to conduct spoofing attacks by hiding the true origin of a webpage in the URL bar using crafted Unicode characters. This can lead to users being deceived into trusting malicious sites, potentially resulting in information disclosure, integrity issues, or other malicious outcomes. However, the impact is limited to spoofing and does not directly enable code execution or privilege escalation. No known exploits in the wild have been reported.

Mozilla has released official fixes for this vulnerability in Firefox 137 and Firefox ESR 128.9. Users and administrators should update affected Firefox installations to these versions or later to remediate the issue. Since the vulnerability is fixed in these releases, no additional mitigation steps are required beyond applying the official updates.