CVE-2020-9987: 
Apple Safari vulnerability analysis and mitigation

CVE-2020-9987 is an address bar spoofing vulnerability discovered in Apple Safari that was fixed in Safari 14.0, released on September 16, 2020. The vulnerability was identified by Rafay Baloch of Cyber Citadel and affects Safari on macOS Catalina and macOS Mojave operating systems. This inconsistent user interface issue could allow attackers to spoof the address bar when users visit malicious websites (Apple Support, CVE Mitre).

The vulnerability stems from an inconsistent user interface issue in Safari's address bar handling. The issue involves JavaScript manipulation of page loads and timing, which can cause either pop-ups to appear from arbitrary websites or render content that falsely appears to come from legitimate websites. The vulnerability was addressed by Apple through improved state management in the browser's user interface (Rapid7).

When exploited, this vulnerability allows attackers to create convincing address bar spoofing attacks where malicious web content appears to come from legitimate websites. This is particularly concerning on mobile devices where screen real estate for security indicators is limited, and the address bar serves as the primary trust indicator for users (Rapid7).

The vulnerability requires a victim to visit a malicious website where the attacker can execute JavaScript. The attack cannot be executed through standard social media platforms or forums that sanitize JavaScript, but could be delivered through phishing emails, text messages, or malicious forum posts. The exploit involves manipulating timing between page loads and address bar updates (Rapid7).

Apple addressed this vulnerability in Safari 14.0, released on September 16, 2020. Users should ensure their Safari browser is updated to version 14.0 or later. For users unable to update immediately, it is recommended to exercise caution when clicking links from unknown sources or suspicious messages (Apple Support).