This vulnerability involves a spoofing issue in the Address Bar component of Firefox Focus for Android, which could allow an attacker to misrepresent the URL displayed to the user. The issue was reported by Kevin Brosnan and is tracked as CVE-2025-9186. It was fixed in Firefox 142 as part of a broader security update that addressed multiple vulnerabilities. The CVSS vector indicates the attack can be performed remotely without privileges but requires user interaction, with no confidentiality impact but high integrity impact and no availability impact.

The vulnerability allows spoofing in the address bar, which can mislead users about the website they are visiting. This can facilitate phishing or social engineering attacks by making malicious sites appear legitimate. However, it does not directly compromise confidentiality or availability. The impact is rated medium based on the CVSS score of 6.5.

A fix for this vulnerability is available in Firefox version 142. Users and administrators should update Firefox Focus for Android to version 142 or later to remediate this issue. There is no indication from the vendor advisory that additional mitigation steps are required beyond applying the update.