Showing the legitimate URL in the address bar while loading the content from other domain. This makes the user believe that the content is served by a legit domain. Exploiting the vulnerability requires the user to click on a specially crafted, seemingly legitimate URL containing an embedded malicious redirect while using F-Secure Safe Browser for iOS.

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-33596
• https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame
• https://www.f-secure.com/en/business/support-and-downloads/security-advisories
• https://www.f-secure.com/en/business/support-and-downloads/security-advisories/cve-2021-33596