CVE-2020-9942: 
Apple Safari vulnerability analysis and mitigation

CVE-2020-9942 is a security vulnerability affecting Safari and macOS Big Sur that was discovered and fixed in 2020. The vulnerability is an inconsistent user interface issue that could allow address bar spoofing when visiting malicious websites. This issue was addressed with improved state management and fixed in macOS Big Sur 11.0.1 and Safari 13.1.2, released on July 15, 2020 (Apple Support).

The vulnerability is classified as an inconsistent user interface issue that could lead to address bar spoofing. It has a CVSS v3.1 Base Score of 4.3 (MEDIUM) with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The vulnerability is associated with CWE-1021 (Improper Restriction of Rendered UI Layers or Frames) and was addressed by improving state management in the affected software (NVD).

When exploited, this vulnerability could allow an attacker to spoof the address bar when a user visits a malicious website. This could potentially lead to phishing attacks where users might be deceived about the actual website they are visiting (Apple Support).

The vulnerability requires user interaction to be exploited, specifically requiring the target to visit a malicious website. The attack can be executed remotely but requires user interaction to succeed (NVD).

Apple addressed this vulnerability by implementing improved state management in the security updates macOS Big Sur 11.0.1 and Safari 13.1.2. Users are advised to update to these versions or later to mitigate the risk (Apple Support).

The vulnerability was discovered and reported by multiple security researchers including an anonymous researcher, Rahul d Kankrale (servicenger.com), Rayyan Bijoora (@Bijoora) of The City School, PAF Chapter, Ruilin Yang of Tencent Security Xuanwu Lab, YoKo Kho (@YoKoAcc) of PT Telekomunikasi Indonesia (Persero) Tbk, and Zhiyang Zeng(@Wester) of OPPO ZIWU Security Lab (Apple Support).