CVE-2015-3755

Vulnerability

WebKit in Apple Safari versions before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly validate malformed URLs. This allows a remote attacker to spoof the browser's user interface. The issue is present in Safari's URL parsing and display logic, affecting all supported platforms including OS X Mountain Lion, Mavericks, Yosemite, and iOS [1][2].

Exploitation

An attacker can host a malicious website that crafts a specially malformed URL. When the user visits this site, Safari's WebKit renders a fake URL in the address bar or prompts the user with a dialog that appears to originate from a trusted site. No additional authentication or user interaction beyond visiting the site is required. The attacker does not need any special network position; the attack is performed remotely via standard web traffic [1][2].

Impact

Successful exploitation allows the attacker to spoof the Safari user interface, leading to potential phishing attacks. The user may be tricked into entering sensitive information or performing actions believing they are interacting with a legitimate website. The impact is limited to UI spoofing; there is no code execution or direct data leakage, but the deception can be used to harvest credentials or other data [1][2].

Mitigation

Apple released fixes in Safari 6.2.8, 7.1.8, and 8.0.8 for OS X, and iOS 8.4.1. Users should update to these versions or later. The patches are available via Apple's software update mechanism [1][2]. No workaround is documented; applying the official updates is the recommended mitigation.