CVE-2019-8670

Vulnerability

An inconsistent user interface issue in Safari, affecting versions prior to 12.1.2 on macOS Sierra 10.12.6, High Sierra 10.13.6, and Mojave 10.14.5, could allow a malicious website to spoof the address bar. The flaw exists in the browser's state management of the address bar content during navigation.

Exploitation

An attacker can exploit this vulnerability by luring a victim to visit a crafted malicious website. No additional privileges or user interaction beyond visiting the site is required. The inconsistent UI state leads the browser to display a different, legitimate URL in the address bar while the page content originates from the attacker's site.

Impact

Successful exploitation results in address bar spoofing, where the user sees a trusted URL but the underlying page content is from an attacker-controlled source. This can be leveraged for phishing attacks, tricking users into entering credentials or other sensitive information.

Mitigation

Apple addressed the issue in macOS Mojave 10.14.6 and Safari 12.1.2, both released on July 22, 2019 [1][2]. Users should update to the latest available versions. There is no known workaround for older, unsupported versions.