CVE-2025-3029 is a vulnerability in Firefox and Thunderbird browsers where a crafted URL containing specific Unicode characters can obscure the true origin of the page, potentially enabling a spoofing attack. This flaw affects Firefox versions prior to 137 and Firefox ESR versions prior to 128.9, as well as Thunderbird versions prior to 137 and Thunderbird ESR versions prior to 128.9. The vulnerability was addressed in Firefox 137 and Firefox ESR 128.9 releases.