CVE-2015-1125

Vulnerability

The touch-events implementation in WebKit on Apple iOS versions prior to 8.3 contains a flaw that allows a crafted website to cause a tap to be associated with an unintended web resource. This affects all devices running iOS 8.2 and earlier [1].

Exploitation

An attacker must host a malicious website and convince the user to visit it. No authentication or special privileges are required. When the user taps on the page, the touch event may be misdirected to a different resource than the one visually indicated, potentially leading to unintended actions.

Impact

Successful exploitation allows the attacker to trigger an association between a user's tap and an unintended web resource. This could result in the user unknowingly clicking on malicious links, ads, or buttons, potentially leading to information disclosure or unwanted actions within the browser context.

Mitigation

Apple addressed this issue in iOS 8.3, released on April 8, 2015 [1]. Users should update to iOS 8.3 or later. No workarounds are available for unpatched versions. This CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.