CVE-2021-44683 : Security Advisory and Response

DuckDuckGo browser version 7.64.4 on iOS is vulnerable to Address Bar Spoofing due to mishandling of the JavaScript window.open function. This allows attackers to lure users into providing sensitive information by displaying a legitimate URL while hosting malicious content.

Understanding CVE-2021-44683

What is CVE-2021-44683?

The CVE-2021-44683 vulnerability in DuckDuckGo browser 7.64.4 on iOS enables Address Bar Spoofing, potentially leading to the disclosure of sensitive user data.

The Impact of CVE-2021-44683

This vulnerability could be exploited by malicious actors to trick users into giving away confidential information, such as credentials, by displaying a trustworthy URL in the address bar.

Technical Details of CVE-2021-44683

Vulnerability Description

The flaw arises from the incorrect handling of the JavaScript window.open function, allowing attackers to show a legitimate URL while the actual content is controlled by the attacker.

Affected Systems and Versions

Product: DuckDuckGo browser
Version: 7.64.4 on iOS

Exploitation Mechanism

By manipulating the JavaScript window.open function, attackers can present a genuine URL in the address bar to deceive users into interacting with malicious content.

Mitigation and Prevention

Immediate Steps to Take

Avoid clicking on suspicious links that may lead to spoofed addresses.
Be cautious while entering personal or sensitive information on websites.

Long-Term Security Practices

Use reputable browsers with security features to mitigate address bar spoofing risks.

Patching and Updates

Update the DuckDuckGo browser to the latest version to patch the vulnerability and enhance security.