Safari UI Research PoC

Address bar spoofing vectors · iOS 18 · iPhone 15

Vector A — Video Fullscreen Exit CVE-class: Media+Spoofing

Trigger navigation at the exact moment Safari exits fullscreen video. The UI transition creates a brief window where the address bar may display a stale/incorrect URL.

1
Tap "Load Video" — video element will appear
2
Tap video to go fullscreen (native iOS fullscreen)
3
Immediately tap "Fire on Exit" button BEFORE exiting fullscreen
4
Exit fullscreen via the ✕ button on iOS
5
Observe URL bar — does it show the injected URL?
Pending
How this works

When Safari exits fullscreen on iOS, there's a UI animation that transitions from the fullscreen player back to the browser chrome. During this transition, history.replaceState() or location.replace() is called. The hypothesis: Safari may update its address bar from the history state after the visual transition completes, creating a window where the bar shows the injected URL while the page content is from the original origin.

Vector B — Navigation Race Inspired by CVE-2025-3071

Chain rapid navigation events to create a race condition in Safari's address bar update cycle. Multiple vectors tested here.

B1 — Rapid pushState Chain
Pending
B2 — Redirect + replaceState
Pending

Open a popup, navigate it rapidly, inject state before close.

B3 — fragment + immediate replace
Pending
Vector C — FileSystem API Dialog CVE-2025-5065 class iOS-specific

Chrome had a UI spoofing bug in FileSystemAccess API. Safari's implementation of the same API may have a different variant — specifically around the file picker dialog display and the URL bar state while the dialog is open.

1
Tap "Open File Picker" — native iOS picker will appear
2
While picker is open, the page triggers state injection
3
Cancel the picker
4
Check: does URL bar show the injected URL?
Pending
C1 — showOpenFilePicker + state injection
C2 — Input[type=file] + navigation timing

Classic file input trigger with URL injection during the "choose file" dialog lifecycle.

Vector D — iOS Gesture Timing iOS-only surface Uninvestigated

Safari iOS has unique gesture surfaces not present in Chrome. These are manual — tap the button, then immediately perform the gesture described.

D1 — Swipe-back during navigation
Pending

Tap "Arm", then immediately swipe right from the left edge of the screen (Safari back gesture).

D2 — Pull-to-refresh race
Pending

Tap "Arm", then immediately pull down to trigger pull-to-refresh on the page.

D3 — Web Share API dismiss race
Pending

Open Web Share sheet, inject state, then dismiss. Check URL bar on return.

Global Event Log

All test events across vectors. Copy this for your report.

Current URL State
window.location.href
—
document.referrer
—
history.length
—
Bug Report Template

If any vector shows a discrepancy, fill this in for Apple's report.