Renwa Hiwa

Universal Cross-Site Scripting (UXSS) exists in the Webkit navigation of Focus for iOS and Klar for iOS. UXSS is a security flaw that allows an attacker to execute malicious scripts across different origins, bypassing the Same-Origin Policy (SOP), which is a critical security mechanism that prevents websites from interacting with data from other websites.

A security issue exists in Focus for iOS that could allow malicious scripts to display attacker-controlled web content under spoofed domains. This is achieved by stalling a navigation to an invalid port, which then triggers an iframe redirect. This results in the user interface displaying a trusted domain without any user interaction.

A crafted URL containing specific Unicode characters could hide the true origin of the page, resulting in a potential spoofing attack.

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 133 Firefox ESR versions prior to 128.5 Thunderbird versions prior to 133 Thunderbird versions prior to 128.5 Description: The issue is related to incorrect restriction of visualized user interface layers in Mozilla Firefox, Firefox ESR, and the Thunderbird email client. A crafted URL containing Arabic script and whitespace characters could hide the true origin of the page, resulting in a potential spoofing attack. This could allow a remote attacker to conduct spoofing attacks. Recommendations: For Firefox versions prior to 133, update to version 133 or later to resolve the issue. For Firefox ESR versions prior to 128.5, update to version 128.5 or later to resolve the issue. For Thunderbird versions prior to 133, update to version 133 or later to resolve the issue. For Thunderbird versions prior to 128.5, update to version 128.5 or later to resolve the issue. As a temporary workaround, consider restricting access to URLs containing Arabic script and whitespace characters to minimize the risk of exploitation.

An incorrect security user interface issue in the Omnibox (the browser's address bar) allows a remote attacker to spoof the contents of the URL bar. This is achieved by using a specially crafted domain name, specifically utilizing two Right-to-Left (RTL) Arabic character subdomains to mislead the user.