Address Bar Spoofing in Contemporary Web Browsers: A Taxonomy, Exploitation Study, and Mitigation Guidelines

Abstract

The browser address bar is the cornerstone of user trust and web security. Despite advancements, address bar spoofing remains a persistent threat, enabling attackers to make malicious URLs appear legitimate. This paper presents an extensive investigation into address bar spoofing vulnerabilities across modern desktop and mobile browsers. We introduce a comprehensive taxonomy classifying over 15 distinct spoofing techniques, many of which are novel. Across systematic testing, over 70 vulnerabilities were identified and responsibly disclosed, resulting in patches across more than 15 browsers. These findings are enumerated in this paper for verification. This research analyzes the root causes of these vulnerabilities, highlighting common pitfalls in URL parsing, display logic, and UI state management. Based on our findings, we propose a robust mitigation framework and best practices for browser developers, alongside actionable advice for users. Our findings underscore the ongoing challenge of maintaining address bar integrity and the critical need for continuous vigilance in browser security. A public repository documents these findings to aid further research.