This vulnerability involves Firefox for Android incorrectly handling blob: URIs in the address bar, allowing the displayed URL to hide the actual origin of the page. This could mislead users about the legitimacy of the site they are visiting, constituting a potential spoofing attack. The issue is specific to the Android platform and was resolved in Firefox 141. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact.

The vulnerability could allow an attacker to craft a URL that hides the true origin of a page in Firefox for Android, potentially misleading users and enabling spoofing attacks. There is no direct confidentiality or availability impact reported. The issue is limited to Android devices running affected versions of Firefox prior to 141. Other operating systems are not affected.

This vulnerability has been fixed in Firefox 141. Users and administrators should update Firefox on Android devices to version 141 or later to remediate this issue. No additional mitigation actions are required as the vendor has provided an official fix.