Referrer URL disclosure via redirect policy override

Information disclosure in Mozilla Firefox before 86 allows remote attackers to send full referrer URLs via conflicting redirect policies. During redirect processing, Firefox adopted a redirect response's Referrer-Policy instead of preserving the policy-derived referrer from the original request, allowing the destination to receive more URL information than the origin intended. Exploitation requires a victim to navigate through an attacker-influenced redirect; the demonstrated consequence is disclosure of referrer path and query data, without evidence of data modification or service interruption.