Pawel Wylecial, a security consultant with Redteam.pl, has published a proof-of-concept exploit for stealing files from iOS and macOS devices via web application code that utilizes the Web Share API.
The security flaw, which isn't too scary as it requires some user interaction, has not yet been repaired, though a patch is being worked on. It's interesting enough to share here so that developers can avoid similar vulnerabilities in their software.
The exploit involves getting someone to open in Safari a web page with a button that triggers the WebShareAPI in a way that launches native Mail or Gmail apps. In doing so, the message can attach a file from the local system, such as the browser history and other sensitive files, while hiding the attachment from view.
It ..
Support the originator by clicking the read the rest link below.
