VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 31, 2004· Updated Apr 16, 2026

CVE-2004-1451

CVE-2004-1451

Description

Mozilla before 1.6 truncates URLs containing %00 in the status bar, enabling phishing by hiding the true destination.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Mozilla before 1.6 truncates URLs containing %00 in the status bar, enabling phishing by hiding the true destination.

Vulnerability

In Mozilla Suite versions prior to 1.6, the status bar truncates the displayed URL when a link contains a %00 (null byte) sequence. The browser only shows the portion of the URL before the null byte, hiding the actual destination. This affects all builds before the fix in version 1.6 [2].

Exploitation

An attacker can craft a hyperlink with a %00 embedded in the URL, such that the visible portion in the status bar appears to point to a trusted site, while the actual target is a malicious domain. No special privileges are required; the attacker only needs to lure the user to hover over the link. The user, seeing a benign URL in the status bar, may be tricked into clicking.

Impact

Successful exploitation enables phishing attacks. The user is misled into visiting an untrusted or malicious site, potentially leading to credential theft, malware installation, or other compromise. The vulnerability facilitates social engineering by hiding the true destination.

Mitigation

The vulnerability was fixed in Mozilla Suite version 1.6, released in 2004 [2]. Users should upgrade to version 1.6 or later. No workarounds are documented for earlier versions. The issue is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.

References
  1. 228176 - %00 in a URL causes incorrect display of hovered link in status bar

AI Insight generated on May 24, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

36
  • Mozilla Corporation/Mozilla36 versions
    cpe:2.3:a:mozilla:mozilla:0.8:*:*:*:*:*:*:*+ 35 more
    • cpe:2.3:a:mozilla:mozilla:0.8:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:0.9.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:0.9.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:0.9.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:0.9.35:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:0.9.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:0.9.4.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:0.9.48:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:0.9.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:0.9.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:0.9.7:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:0.9.8:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:0.9.9:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.0:rc1:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.0:rc2:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.1:alpha:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.1:beta:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.2:alpha:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.2:beta:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.3.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.4.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.4.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.4.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.4:alpha:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.4:beta:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.5.1:*:*:*:*:*:*:*
    • (no CPE)range: <= 1.6

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

3

News mentions

0

No linked articles in our index yet.