What’s Vulnerable › Vulnerabilities

CVE-2021-40835: URL Address Bar Spoofing in F-Secure SAFE Browser for iOS

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-12-16 · updated 2026-06-17

Description

An URL Address bar spoofing vulnerability was discovered in Safe Browser for iOS. When user clicks on a specially crafted a malicious URL, if user does not carefully pay attention to url, user may be tricked to think content may be coming from a valid domain, while it comes from another. This is performed by using a very long username part of the url so that user cannot see the domain name. A remote attacker can leverage this to perform url address bar spoofing attack. The fix is, browser no longer shows the user name part in address bar.

Affected products

• F-Secure SAFE Browser for Android Version 18.5: before 18.3 — fixed in 18.3

How to fix

Upgrade to a fixed version: F-Secure SAFE Browser for Android Version 18.5 18.3. Check the vendor advisory for mitigations.

References

• https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame
• https://www.f-secure.com/en/business/support-and-downloads/security-advisories
• https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame
• https://www.f-secure.com/en/business/support-and-downloads/security-advisories

Get alerted when CVE-2021-40835 or the next vulnerability affects your stack