CVE-2024-11695: Mozilla Firefox URL Spoofing Vulnerability

CVE-2024-11695 Overview

CVE-2024-11695 is a URL spoofing vulnerability affecting Mozilla Firefox and Thunderbird. A crafted URL containing Arabic script combined with whitespace characters could hide the true origin of a page rendered in the address bar. Attackers can leverage this behavior to conduct phishing and other social engineering attacks by misrepresenting the domain a user is visiting. The flaw is classified under CWE-1021 (Improper Restriction of Rendered UI Layers or Frames) and requires user interaction to exploit.

Critical Impact
Attackers can present a spoofed origin in the browser address bar, enabling convincing phishing pages that appear to load from legitimate domains.

Affected Products

Mozilla Firefox versions prior to 133
Mozilla Firefox ESR versions prior to 128.5
Mozilla Thunderbird versions prior to 133 and prior to 128.5

Discovery Timeline

2024-11-26 - CVE-2024-11695 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11695

Vulnerability Analysis

The vulnerability resides in how Firefox and Thunderbird render URLs that mix right-to-left (RTL) Arabic script with whitespace characters. When these character classes are combined in a specially crafted URL, the browser's address bar rendering logic fails to preserve the visual ordering that would accurately reflect the true origin. The result is a mismatch between the displayed URL and the actual domain serving content. This is a user interface (UI) spoofing issue, not a memory safety or code execution flaw. Successful exploitation depends on convincing a target to click a crafted link, at which point the displayed origin can be manipulated to disguise phishing infrastructure as a trusted site.

Root Cause

The root cause is inadequate normalization of bidirectional (BiDi) text combined with whitespace in the URL bar rendering pipeline. Arabic script triggers RTL rendering behavior, and interleaved whitespace characters can reorder the visible components of the URL in ways that hide portions of the true host. Because the underlying URL string parsed by the browser differs from the visual representation, users cannot distinguish the spoofed origin from a legitimate one by inspection alone.

Attack Vector

Exploitation requires a network-reachable attacker to deliver a crafted URL to a victim through email, messaging, or a compromised website. The victim must interact with the link to trigger the spoofed address bar rendering. Once the user is on the attacker-controlled page, the address bar displays a URL that appears to belong to a trusted origin, increasing the likelihood that the user will enter credentials or sensitive data. Because Thunderbird renders links in message bodies, malicious emails can leverage the same rendering flaw. Further technical detail is available in Mozilla Bug 1925496.

Detection Methods for CVE-2024-11695

Indicators of Compromise

URLs delivered via email or chat that contain mixed Arabic script and unusual whitespace or control characters in the host or path components.
Outbound connections from Firefox or Thunderbird processes to newly registered domains immediately following user interaction with an inbound link.
Web proxy logs showing punycode or percent-encoded Arabic characters in host fields that do not match expected user browsing patterns.

Detection Strategies

Inspect inbound email content for anchor tags whose displayed text and href attribute contain BiDi or whitespace character mismatches.
Enumerate Firefox and Thunderbird versions across the fleet and flag any hosts running versions below Firefox 133, Firefox ESR 128.5, or Thunderbird 128.5/133.
Correlate phishing report telemetry against user-agent strings to identify clusters of victims running vulnerable browser versions.

Monitoring Recommendations

Enable URL logging on email security gateways with Unicode-aware parsing to surface BiDi and whitespace tricks in message links.
Monitor endpoint DNS queries for lookups triggered by Firefox and Thunderbird that resolve to domains flagged by threat intelligence as phishing infrastructure.
Track credential submission events to non-corporate domains originating from Firefox or Thunderbird sessions.

How to Mitigate CVE-2024-11695

Immediate Actions Required

Upgrade Firefox to version 133 or later, Firefox ESR to 128.5 or later, and Thunderbird to 128.5 or 133 or later on all managed endpoints.
Push updated browser policies through enterprise management tooling to ensure users cannot defer the upgrade indefinitely.
Reinforce phishing awareness guidance so users verify domains through means other than address bar inspection until patching is complete.

Patch Information

Mozilla addressed CVE-2024-11695 in the security releases documented in MFSA-2024-63, MFSA-2024-64, MFSA-2024-67, and MFSA-2024-68. Debian users should apply the fixed packages announced in the Debian LTS advisory.

Workarounds

Configure email security gateways to strip or rewrite links that contain mixed RTL script and whitespace characters in the host component.
Deploy browser policies that force punycode display of internationalized domain names to reduce visual ambiguity.
Restrict Thunderbird from automatically rendering HTML message bodies for high-risk user groups until patches are deployed.

bash

# Configuration example: force punycode display in Firefox via policies.json
{
  "policies": {
    "Preferences": {
      "network.IDN_show_punycode": {
        "Value": true,
        "Status": "locked"
      }
    }
  }
}