CVE-2016-6908 in Web Browser
Summary
by MITRE
Characters from languages are such as Arabic, Hebrew are displayed from RTL (Right To Left) order in Opera 37.0.2192.105088 for Android, due to mishandling of several unicode characters such as U+FE70, U+0622, U+0623 etc and how they are rendered combined with (first strong character) such as an IP address or alphabet could lead to a spoofed URL. It was noticed that by placing neutral characters such as "/", "?" in filepath causes the URL to be flipped and displayed from Right To Left. However, in order for the URL to be spoofed the URL must begin with an IP address followed by neutral characters as omnibox considers IP address to be combination of punctuation and numbers and since LTR (Left To Right) direction is not properly enforced, this causes the entire URL to be treated and rendered from RTL (Right To Left). However, it doesn't have be an IP address, what matters is that first strong character (generally, alphabetic character) in the URL must be an RTL character.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 05/14/2026
This vulnerability represents a sophisticated internationalization-based spoofing attack that exploits Unicode rendering behaviors in Opera's Android browser implementation. The flaw stems from improper handling of right-to-left text directionality within the browser's URL display mechanism, specifically affecting how Unicode characters with specific code points such as U+FE70, U+0622, and U+0623 are processed during text rendering. The vulnerability operates through a combination of Unicode bidirectional algorithm misapplication and improper enforcement of left-to-right text directionality for URL components. When an attacker constructs a malicious URL containing specific RTL Unicode characters in strategic positions, particularly those that are neutral in the bidirectional algorithm, the browser's rendering engine fails to properly enforce the expected left-to-right display order for the URL structure.
The technical exploitation relies on the browser's interpretation of the "first strong character" principle within Unicode bidirectional text processing, where the initial character that establishes text directionality determines the overall rendering direction. In this case, when an IP address appears at the beginning of the URL, the browser treats it as a sequence of punctuation and numeric characters, which are considered neutral in directionality. However, the subsequent insertion of specific RTL Unicode characters causes the entire URL to be rendered in right-to-left order, creating a visual deception that can make the URL appear to originate from a different domain than actually specified. This behavior violates fundamental security assumptions about URL display integrity and allows for potential phishing attacks where malicious actors can craft URLs that appear legitimate when viewed in the browser's address bar but actually point to different destinations.
The operational impact of this vulnerability extends beyond simple visual deception to represent a significant security risk in mobile browsing environments where users may not carefully inspect URL displays. The attack vector specifically targets the browser's omnibox rendering system, which is responsible for displaying and validating URL information to users. According to CWE-116, this vulnerability falls under improper encoding or representation of data, while the technique aligns with ATT&CK tactic TA0001 (Initial Access) and technique T1566 (Phishing) through the manipulation of URL display to deceive users. The vulnerability's effectiveness is particularly concerning in mobile environments where screen real estate is limited and users may not scrutinize URL displays as carefully as they would on desktop systems. The specific character combinations required for exploitation demonstrate that this is not a random rendering issue but a carefully crafted vulnerability that leverages the complex interaction between Unicode bidirectional text processing and browser URL rendering logic.
Mitigation strategies should focus on implementing strict enforcement of left-to-right text directionality for URL components regardless of Unicode character content, particularly ensuring that the first strong character determination does not override the expected display order for web addresses. Browser vendors should implement comprehensive Unicode bidirectional algorithm compliance testing for URL rendering components, and the fix should address the core issue of how neutral characters in URL paths interact with directional override sequences. Security professionals should monitor for similar vulnerabilities in other browsers and web applications that may exhibit similar Unicode rendering behaviors, as this class of vulnerability represents a broader category of internationalization-based security flaws. The remediation approach must ensure that URL display behavior remains consistent regardless of the presence of Unicode characters, maintaining the fundamental security principle that users should be able to trust the URL displayed in their browser's address bar as representing the actual destination of their web navigation.