CVE-2021-40835: 
NixOS vulnerability analysis and mitigation

An URL Address bar spoofing vulnerability was discovered in Safe Browser for iOS. When a user clicks on a specially crafted malicious URL containing a very long username part, they may be tricked into thinking content is coming from a valid domain while it actually comes from another domain, as the user cannot see the domain name due to the length of the username portion (NVD).

The vulnerability was assigned a CVSS v3.1 Base Score of 4.3 (MEDIUM) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The attack requires user interaction and can be launched remotely without requiring privileges. The vulnerability affects F-Secure Safe Browser for iOS versions up to (excluding) 18.3 (NVD).

A remote attacker can leverage this vulnerability to perform URL address bar spoofing attacks, potentially tricking users into believing they are interacting with a legitimate domain while actually accessing malicious content (NVD).

The vulnerability was fixed in version 18.3 of F-Secure Safe Browser for iOS. The fix involves no longer showing the username part in the address bar (NVD).