Low firefox Logic Error 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactlow
DescriptionSpoofing issue in Firefox
ComponentCore
Bug ClassLogic Error
Tracker1994164
Fix commit68f1d00e0094 (firefox) +6/-3
CISA KEVNot listed
CreditedEemeli Aro
Disclosed2025-11-11

Changed Functions

FunctionChangeNotes
if
browser/base/content/browser.js
modified

Files Changed

  • browser/base/content/browser.js
diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js
index 66db788f523..b0e33b5a0c6 100644
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -1964,10 +1964,13 @@ var XULBrowserWindow = {
     if (url) {
       url = Services.textToSubURI.unEscapeURIForUI(url);
 
-      // Encode bidirectional formatting characters.
-      // (RFC 3987 sections 3.2 and 4.1 paragraph 6)
+      /**
+       * Encode bidirectional formatting characters.
+       * @see https://url.spec.whatwg.org/#url-rendering-i18n
+       * @see https://www.unicode.org/reports/tr9/#Directional_Formatting_Characters
+       */
       url = url.replace(
-        /[\u200e\u200f\u202a\u202b\u202c\u202d\u202e]/g,
+        /[\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/g,
         encodeURIComponent
       );
 
Loading diff…