CVE-2020-9784: 
Apple Safari vulnerability analysis and mitigation

A logic issue vulnerability (CVE-2020-9784) was discovered in Apple Safari that allowed a malicious iframe to use another website's download settings. The vulnerability was fixed in Safari 13.1, which was released on March 24, 2020. The issue was discovered by Ruilin Yang of Tencent Security Xuanwu Lab and Ryan Pickren (Apple Advisory).

The vulnerability was classified with a CVSS v3.1 Base Score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The issue stemmed from a logic flaw in Safari's handling of iframe download settings, which was addressed by implementing improved restrictions (NVD).

The vulnerability could allow a malicious iframe to manipulate download settings associated with other websites, potentially leading to security implications for users' download configurations (Apple Advisory).

Apple addressed this vulnerability by implementing improved restrictions in Safari 13.1. The fix was made available for macOS Mojave and macOS High Sierra, and was included in macOS Catalina. Users should update to Safari 13.1 or later to protect against this vulnerability (Apple Advisory).