Launchpad.net

CVE 2016-5267

Mozilla Firefox before 48.0 on Android allows remote attackers to spoof the address bar via left-to-right characters in conjunction with a right-to-left character set.

See the CVE page on Mitre.org for more details.

References