CVE-2021-40835 : What You Need to Know

URL Address Bar Spoofing vulnerability in F-Secure Mobile Security for iOS allows remote attackers to spoof the address bar in Safe Browser.

Understanding CVE-2021-40835

An URL Address bar spoofing vulnerability was discovered in Safe Browser for iOS, where a specially crafted URL could trick users into thinking content is from a valid domain when it's not, leading to potential spoofing attacks.

What is CVE-2021-40835?

Vulnerability Type: URL Address Bar Spoofing
Vendor: F-Secure
Affected Product: F-Secure Mobile Security
Affected Version: 18.3 (custom version)
Fixed in version: 18.5

The Impact of CVE-2021-40835

CVSS Base Score: 4.6 (Medium)
Attack Vector: Network
User Interaction: Required
Exploitation could result in URL address bar spoofing attacks.

Technical Details of CVE-2021-40835

URL Address Bar Spoofing in F-Secure SAFE Browser for iOS involves:

Vulnerability Description

Allows a remote attacker to perform URL address bar spoofing by manipulating the URL to hide the true domain.

Affected Systems and Versions

Platforms: iOS
Product: F-Secure Mobile Security
Versions Affected: < 18.5

Exploitation Mechanism

Attacker sends a specially crafted URL to the victim, who may mistake it for a legitimate domain due to the hidden true domain in the URL.

Mitigation and Prevention

To address CVE-2021-40835, follow these steps:

Immediate Steps to Take

Upgrade to version 18.5 or newer from the App Store.

Long-Term Security Practices

Always verify URLs before clicking, especially those with suspiciously long and hidden parts.

Patching and Updates

Regularly update the F-Secure Mobile Security application to the latest available version.