In short, it allows scammers to display a fake URL bar and hide the real one. Users accessing websites from their computers are not in jeopardy, since all popular web browsers do not allow websites to modify in any way the text in the address bar or to hide the address bar itself.
There are two mitigating circumstances that allow alert users to spot the trick:
- While the page loads, the real address bar is visible
- When the page is rendered, the real address bar is visible if the user scrolls up.
He says that he notified Apple about the issue, but that they could not say when it will be addressed.
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.