ecurity researcher Jordi Chancel reported that on Firefox for Android, when a URL is pasted with an unknown protocol, such as secure: or httpz, the pasted URL is shown in the addressbar but no navigation occurs. Other address bar attributes present before this pasted URL is entered will continue to be rendered. This could lead to potential spoofing by a malicious site. This issue only affects Firefox for Android and does not affect Firefox on OS X, Linux, or Windows operating systems. Upstream bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1162372 External References: https://www.mozilla.org/en-US/security/advisories/mfsa2015-99/
Acknowledgements: Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Jordi Chancel as the original reporter.