{"id":"CVE-2026-124936","kind":"vulnerability","aliases":["CVE-2026-124936"],"related":[],"title":"Firefox: Address Bar spoofing flaw lets a page fake the URL shown","description":"Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 160.","summary":"A spoofing flaw in the Firefox Address Bar can make a page display a misleading address. An attacker could use this to pass off a fake site as a trusted one.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Firefox","fixed":[],"affected":"","ecosystem":"runtime"}],"ecosystems":["runtime"],"tags":["browser","desktop","firefox","other"],"not_affected_if":["firefox-160-or-later"],"how_to_check":"- Check the Firefox version with Help > About Firefox\n- Versions below `160` are reported as affected by the source text","fix":"- Firefox: `160`","status":"open","published_at":"2026-11-10T14:17:27+00:00","first_seen_at":"2026-11-10T14:22:19+00:00","triaged_at":"2026-11-10T14:24:12+00:00","updated_at":"2026-11-10T14:24:12+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T14:24:12Z","model":"claude-haiku-5-5","output":{"fix":"- Firefox: `160`","reach":"internet","title":"Firefox: Address Bar spoofing flaw lets a page fake the URL shown","impact":"medium","summary":"A spoofing flaw in the Firefox Address Bar can make a page display a misleading address. An attacker could use this to pass off a fake site as a trusted one.","audience":"everyone","category":"other","nicknames":[],"who_cares":["firefox","browser","desktop"],"confidence":0.5,"fix_status":"available","needs_auth":"no","worst_case":"A user is shown a fake address and trusts a spoofed site","analyst_note":"Confirm the affected version range and exploitation details from the Mozilla advisory or the NVD entry, since the sources give only a one-line description.","how_to_check":"- Check the Firefox version with Help > About Firefox\n- Versions below `160` are reported as affected by the source text","plain_action":"Update Firefox to version 160 or later: Menu > Settings > General > Firefox Updates.","product_name":"Firefox","needs_analyst":true,"not_affected_if":["firefox-160-or-later"],"who_is_affected":"Desktop users of Firefox before version 160 are affected, since the flaw sits in the browser's Address Bar. The sources do not say whether specific settings or sites are required. Teams can skip this for managed browsers already on 160 or later.","user_interaction":"yes","product_ecosystem":"runtime","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000709,"input_tokens":4457,"output_tokens":526,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124936':15A,18A '-2026':14A,17A '160':67C 'address':2A,29B,38B,58C 'attack':40B 'bar':3A,30B,59C 'browser':20B 'compon':60C 'could':41B 'cve':13A,16A 'desktop':21B 'display':35B 'fake':9A,48B 'firefox':1A,19A,22B,28B,66C 'fix':64C 'flaw':5A,25B 'issu':55C 'let':6A 'make':32B 'mislead':37B 'one':53B 'page':8A,34B 'pass':45B 'shown':12A 'site':49B 'spoof':4A,24B,54C 'trust':52B 'url':11A 'use':42B 'vulner':62C","nicknames":[],"mitigations":[],"who_affected":"Desktop users of Firefox before version 160 are affected, since the flaw sits in the browser's Address Bar. The sources do not say whether specific settings or sites are required. Teams can skip this for managed browsers already on 160 or later.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Firefox to version 160 or later: Menu > Settings > General > Firefox Updates.","pkeys":["firefox"],"ptokens":["firefox"],"labels":["browser","desktop","firefox","other","runtime","unknown"],"campaign_type":null,"search_a":"'-124936':15A,18A '-2026':14A,17A 'address':2A 'bar':3A 'cve':13A,16A 'fake':9A 'firefox':1A,19A 'flaw':5A 'let':6A 'page':8A 'shown':12A 'spoof':4A 'url':11A","search_b":"'address':29B,38B 'attack':40B 'bar':30B 'browser':20B 'could':41B 'desktop':21B 'display':35B 'fake':48B 'firefox':22B,28B 'flaw':25B 'make':32B 'mislead':37B 'one':53B 'page':34B 'pass':45B 'site':49B 'spoof':24B 'trust':52B 'use':42B","search_c":"'160':67C 'address':58C 'bar':59C 'compon':60C 'firefox':66C 'fix':64C 'issu':55C 'spoof':54C 'vulner':62C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T14:17:27+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124936","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124936","severity":null,"published_at":"2026-11-10T14:17:27+00:00","modified_at":"2026-11-10T14:17:27+00:00","first_seen_at":"2026-11-10T14:22:19+00:00","fetched_at":"2026-11-10T14:22:19+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}