/
Navigation
Chronicles
Browse all articles
Explore
Semantic exploration
Research
Entity momentum
Nexus
Correlations & relationships
Story Arc
Topic evolution
Drift Map
Semantic trajectory animation
Posts
Analysis & commentary
Pulse API
Tech news intelligence API
Browse
Entities
Companies, people, products, technologies
Domains
Browse by publication source
Handles
Browse by social media handle
Detection
Concept Search
Semantic similarity search
High Impact Stories
Top coverage by position
Sentiment Analysis
Positive/negative coverage
Anomaly Detection
Unusual coverage patterns
Analysis
Rivalry Report
Compare two entities head-to-head
Semantic Pivots
Narrative discontinuities
Crisis Response
Event recovery patterns
Connected
Search: /
Command: ⌘K
Embeddings: large
TEXXR

Chronicles

The story behind the story

days · browse · Enter similar · o open

Researcher discovers address bar spoofing bugs in Safari, Opera, and Yandex, all now fixed, but other popular browsers, like UC Browser, have not issued a patch

TechCrunch Zack Whittaker

Context & Ripple Effects

Safari keeps returning to the same bug class: researchers found an address-spoofing flaw in iOS and OS X Safari back in 2015, and in 2018 a spoofing demo against Safari and Edge saw Microsoft patch quickly while Apple lagged. The new disclosure extends the pattern beyond Apple — Opera and Yandex have now shipped fixes for their own address bar spoofing bugs.

First-order effects

  • UC Browser users are the immediate exposure: with Safari, Opera, and Yandex patched, UC is the remaining popular browser where a malicious link can still display a forged address bar.
  • Apple closes another chapter in a recurring file — this is at least the third Safari address-spoofing disclosure since 2015, each resolved only after researcher pressure.

Second-order effects

  • Browsers that patch slowly accumulate a track record that security-conscious buyers can price: UC's unpatched status hands rivals like Chrome and Firefox a concrete trust argument in markets where UC competes on size.
  • The disclosure gives enterprises and mobile carriers a fresh data point for vetting preinstalled or bundled browsers, where UC is commonly distributed.

Third-order effects

  • If the pattern holds, browser security becomes less about which vendor has fewer bugs and more about which one closes them fastest — patch latency itself turns into the competitive metric, and slow responders face growing pressure from researchers who disclose publicly rather than wait.

The trend: Browser address-bar spoofing keeps resurfacing across vendors and years, shifting the real differentiator from bug counts to how quickly each vendor ships fixes.

Discussion

  • @techjournalist Sean Kerner on x
    What's amazing to me about this set of vulns is how it spoofs what *should* be secure https addresses.. https://twitter.com/...
  • @campuscodi Catalin Cimpanu on x
    Affected browsers include Apple Safari, Opera Touch, and Opera Mini, but also niche ones like Bolt, RITS, UC Browser, and Yandex Browser The big names patched, the smaller browsers did not. Technical report to go live later today here (currently 404): https://www.rafaybaloch.com/…
  • @rafaybaloch Rafay Baloch on x
    My technical writeup on Multiple Address Bar spoofing vulnerabilities in Mobile browsers has been published. Please note that several other browsers are working on fix and the page will be updated as soon as timeline has elapsed. #spoofing #browsersec https://www.rafaybaloch.com/…
  • @rapid7 @rapid7 on x
    Excited to share a coordinated vulnerability disclosure with longtime friend of Rapid7, researcher @rafaybaloch. Today, we're disclosing a set of address bar spoofing vulns that affect mobile browsers ranging from Apple Safari to Bolt Browser. https://blog.rapid7.com/...