Pakistani white-hat hacker finds vulnerabilities in multiple mobile browsers

Renowned Pakistani white-hat hacker and information security researcher, Rafay Baloch, has found vulnerabilities in multiple browsers.

Rafay has published a detailed paper on his website about the vulnerabilities and the browsers that are currently affected by them. Currently, most of us trust a website if the URL at the top looks okay. According to the demonstration made by Rafay, this can be exploited by a technique called address bar spoofing.

This works by showing the same URL as a site you trust while you are on a different site altogether. Say you want to go to bing.com so you click on a link to take you to Bing. You look at the top and it says bing.com but it won’t be Bing.

He has done this by using the following code (if you don’t understand code, you can just skip to the output image):

<p class="test"><input class="btn btn-success btn-lg" type="button" value="Run test case"
>
window.open(&quot;https://www.bing.com&quot;, &quot;WIN&quot;);
win.window.stop();
win.document.write('This is not Facebook');
win.document.close();
" /></p>