CVE-2012-0585

Vulnerability

The vulnerability resides in the Private Browsing feature of Safari in Apple iOS versions prior to 5.1. It allows web pages to bypass intended privacy settings by using JavaScript code that calls the pushState() or replaceState() methods of the History API. This can insert entries into the browsing history even when Private Browsing mode is active, undermining the feature's core purpose of not recording visited pages. The affected versions are iOS 5.0 and earlier.

Exploitation

An attacker can exploit this remotely by hosting a malicious webpage or injecting JavaScript into a legitimate page (e.g., via a cross-site scripting vulnerability). The user only needs to visit the crafted page while Private Browsing is enabled. No additional authentication or user interaction beyond visiting the page is required.

Impact

Successful exploitation allows the attacker to populate the user's browser history with arbitrary entries, defeating the privacy protections of Private Browsing. This can be used for user tracking, history-based attacks, or to leave traces of visited content despite the user's expectation of no history being recorded.

Mitigation

Apple addressed this vulnerability in iOS 5.1, released on March 7, 2012 [1]. Users should update their devices to iOS 5.1 or later to mitigate the issue. No workarounds are available for affected versions.