CVE-2023-4579

What it actually does

A crafted search query that is a syntactically valid URL can be displayed in the address bar as if it were the current navigation target when performed through a user-configured default search engine, enabling visual spoofing of origin.

Why it matters to the business

Users may be misled into interacting with attacker-controlled sites under the false impression they are on a legitimate domain, increasing risk of credential theft or social-engineering success; the issue is limited to browsers where an attacker can influence the default search engine setting.

How an attack unfolds

An attacker first convinces or forces a victim to install a malicious search engine as the browser default, then supplies a search term that is a well-formed attacker URL; the browser renders that URL in the address bar, completing the spoof without further user interaction beyond performing the search.

How to fix it

Upgrade Mozilla Firefox to version 117 or later; verify that enterprise policies or user settings do not override the updated default search engine behavior.

How to confirm the fix worked

Confirm browser version is at least 117; test by setting a search engine whose query returns a well-formed URL and verify the address bar no longer displays the query verbatim as the current location.

Typical attack path

1. Attacker distributes or tricks user into adding malicious search engine
2. User performs a search using a query string that parses as a valid URL
3. Browser address bar displays the search query as the navigated location
4. Victim is visually convinced they are on the attacker-chosen site

How to detect it

Review browser configuration logs or preference files for unexpected changes to the default search engine; inspect user-initiated search events that contain URL-like strings in telemetry or history exports.

What your security team should do

• Prioritize deployment of Firefox 117+ across all managed endpoints
• Audit and restrict methods that allow users to change the default search engine
• Include browser version checks in endpoint compliance scans