What’s Vulnerable › Vulnerabilities

CVE-2021-33596: Fake Apple login prompt in F-Secure SAFE browser for iOS

• Severity: medium (CVSS 4.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-08-05 · updated 2026-06-17
• Weakness: CWE-1021

Description

Showing the legitimate URL in the address bar while loading the content from other domain. This makes the user believe that the content is served by a legit domain. Exploiting the vulnerability requires the user to click on a specially crafted, seemingly legitimate URL containing an embedded malicious redirect while using F-Secure Safe Browser for iOS.

Affected products

• F-Secure SAFE Browser for Android Version 18.5: before 18.4.272901 — fixed in 18.4.272901

How to fix

Upgrade to a fixed version: F-Secure SAFE Browser for Android Version 18.5 18.4.272901. Check the vendor advisory for mitigations.

References

• https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame
• https://www.f-secure.com/en/business/support-and-downloads/security-advisories
• https://www.f-secure.com/en/business/support-and-downloads/security-advisories/cve-2021-33596
• https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame
• https://www.f-secure.com/en/business/support-and-downloads/security-advisories
• https://www.f-secure.com/en/business/support-and-downloads/security-advisories/cve-2021-33596

Get alerted when CVE-2021-33596 or the next vulnerability affects your stack