CVE-2023-5732

What it actually does

The vulnerability allows an attacker to embed bidirectional Unicode characters in a URL so that the rendered address bar displays a spoofed, trusted-looking origin while the actual destination remains attacker-controlled.

Why it matters to the business

Users may be tricked into visiting malicious sites or disclosing credentials, increasing the risk of account takeover, data theft, or malware infection across the organization.

How an attack unfolds

An attacker crafts a URL containing right-to-left override characters that visually reorder the displayed address, hosts the page on a malicious domain, and delivers the link through phishing email, compromised site, or social media; when the victim clicks, the browser shows a trusted domain in the address bar while loading attacker content.

How to fix it

Upgrade Mozilla Firefox to version 117 or later, Firefox ESR to 115.4 or later, and Thunderbird to 115.4.1 or later. Apply vendor patches as soon as they become available for any downstream distributions.

How to confirm the fix worked

Verify installed browser and mail client versions against the fixed releases; test address-bar rendering with known bidirectional-character test URLs after the update to confirm spoofing is prevented.

Typical attack path

1. Craft URL containing bidirectional Unicode characters that visually spoof a trusted domain
2. Host malicious page on attacker-controlled domain
3. Deliver link via phishing email, messaging, or compromised website
4. Victim clicks link and observes spoofed address bar
5. Victim enters credentials or downloads and executes malware

How to detect it

Examine web proxy, browser history, and email logs for URLs containing Unicode bidirectional control characters (U+202E, U+202D, U+2066–U+2069) that resolve to unexpected domains; correlate with subsequent credential submission or file-download events.

What your security team should do

• Immediately deploy the listed browser and client updates to all endpoints
• Block or monitor traffic to domains known to host phishing pages that abuse bidirectional characters
• Educate users to manually inspect the full URL and hover over links before entering credentials
• Review email security controls to flag messages containing suspicious Unicode in URLs