Safari exploit gives your contact info to malicious websites

Someone else pointed out that there is a working demo, but even if there weren't the theory behind the attack doesn't push any boundaries - all the technologies it describes are well-established and predictable, unless Safari had some unknown defence in place against javascript input simulation.

I turned off autocomplete from address book the moment I saw this, and hope Apple sees it as a flaw and offers a fix.

I promise guys, I'll make sure not to write a rush post without having consumed some coffee yet. ;-)

/me embarrassed.

Sure I'm biased, everyone is biased. Personally, my bias is that while I've flirted with just about every browser out there Safari is my one true love (well, now that it has extensions. :)

I would also point out that other credible publications are reporting the list from that report with Apple on top for number, not severity, of security issues. This isn't some random nobody security company. Hit the Ars link, you don't get more credible then them.

You're right, there may not be a *malicious exploit* out in the wild but I think the demo of the exploit linked in his article should be classified as an exploit, as willyu34 already pointed out.

you are not suppose to believe everything from the Internet, that's why you have to do researches on claims.

If you did bother do ANY kind of research, or even read source article before you call the article bullshit, you'll realize that Jeremiah Grossman ALREADY have a WORKING DEMO which he'll be showing people at blackhat next week. It will show the web server receiving the address book information in the replies, without user interaction.

There's a reason I use 1Password instead of enabling autofill.

yeah, REAL anonymous..

"JEREMIAH also mentions that he did report this vulnerability privately to Apple on June 17th."

From Secunia's website:

"Secunia provides free tools for the consumers as we want to ensure that PC users have easy access to reliable vulnerability management tools."

What market share has this free software got? Publicity off Apple's back?

So don't go to malicious sites...

Good thing I use Chrome...

I love butter.