Tuesday, April 22, 2025
HomeAppleiOS/macOS Webcam Can be Hacked With A Single Click On Malformed Link...

iOS/macOS Webcam Can be Hacked With A Single Click On Malformed Link – Hacker Rewarded $75,000

Published on

SIEM as a Service

Follow Us on Google News

By just making the users visiting a link, an attacker can hack the users’ iOS/macOS Camera using zero-day bugs in Safari.

With iOS and macOS camera security model every app needs to assigned permission manually but Apple’s own app such as Safari gets access by default.

Security researcher Ryan Pickren discovered seven new vulnerabilities with Safari browser that allows attackers to access your device’s camera, microphone, or location, and in some cases, saved passwords as well.

- Advertisement - Google News
iOS/macOS Webcam

Pickren said that Safari not using the method of the origin to keep track of the open website, “I deduced that Safari was likely running a Generic URI Syntax parser against all open windows to get the URIs’ hostnames, then doing some extra parsing on those.”

Exploiting Bugs to Access Camera

He started exploiting using javascript: data: and about, but that fails, but while parsing file: which specified for remote or FTP purpose(file://host.example.com/Share/path/to/file.txt).

iOS/macOS Webcam

Safari parses it as a normal file URI, “the page actually accepted this URI as valid and reloaded the same content. Which means I just changed the document.domain using this really dumb trick. (CVE-2020-3885).”

So now the Safari browser thinks the website connected is skype9.0com, by opening the local file attackers can run a malicious script and gain access to Camera, Microphone, and Screen Sharing.

He found another bug (CVE-2020-9784 & CVE-2020-3887) to bypass the auto-download prevention in the Safari browser.

By using blob://skype.com URI a popup can be triggered and can be used to execute the arbitrary JavaScript.

Trying all chain of bugs can grant access to iOS/macOS camera, microphone, or location, and in some cases, saved passwords.

Following are the seven bugs

CVE-2020-3852 – A logic issue was addressed with improved validation.

CVE-2020-3864 – A DOM object context may not have had a unique security origin

CVE-2020-3865 – A top-level DOM object context may have incorrectly been considered secure

CVE-2020-3885 – File URL processed incorrectly.

CVE-2020-3887 – A download’s origin may be incorrectly associated

CVE-2020-9784 – Malicious iframe use another website’s download settings

CVE-2020-9787 – Hostnames with a dash (-) and period (.) are ignored

iOS/macOS Webcam

All the vulnerabilities patched in January and March updates. The researcher receives $75,000 for the bug submission.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Infostealer Attacks Surge 84% Weekly Through Phishing Emails

The volume of infostealer malware distributed through phishing emails has surged by 84% week-on-week...

North Korean IT Workers Use Real-Time Deepfakes to Infiltrate Organizations Through Remote Jobs

A division of Palo Alto Networks, have revealed a sophisticated scheme by North Korean...

New Phishing Technique Hides Weaponized HTML Files Within SVG Images

Cybersecurity experts have observed an alarming increase in the use of SVG (Scalable Vector...

Detecting And Blocking DNS Tunneling Techniques Using Network Analytics

DNS tunneling is a covert technique that cybercriminals use to bypass traditional network security...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Hackers Abuse Zoom’s Remote Control to Access Users’ Computers

A newly uncovered hacking campaign is targeting business leaders and cryptocurrency firms by abusing...

Speedify VPN Vulnerability on macOS Exposes Users to System Takeover

A major security flaw in the Speedify VPN application for macOS, tracked as CVE-2025-25364, has...

Critical PyTorch Vulnerability Allows Hackers to Run Remote Code

A newly disclosed critical vulnerability (CVE-2025-32434) in PyTorch, the widely used open-source machine learning...