A critical security flaw in Apple’s Safari web browser allows cybercriminals to execute browser-in-the-middle (BitM) attacks by exploiting the Fullscreen API. SquareX researchers have documented an alarming increase in these attacks, which are particularly effective against Safari users due to the browser’s inadequate fullscreen mode notifications.

## How the Attack Works

The BitM technique involves tricking users into interacting with an attacker-controlled remote browser displaying legitimate login pages. Using tools like noVNC, attackers can overlay a remote browser session on top of the victim’s browser. When users enter their credentials, the information is captured while victims still successfully access their accounts, leaving them unaware of the theft.

The attack sequence typically begins with:
1. Users clicking malicious links from sponsored ads, social media posts, or comments
2. Being redirected to a convincing fake website impersonating a legitimate service
3. Clicking a login button that activates a hidden BitM window
4. The attacker’s browser entering fullscreen mode, covering the fake site with the legitimate website

## Safari’s Unique Vulnerability

While Firefox and Chromium-based browsers (Chrome, Edge) display clear warnings when entering fullscreen mode, Safari only shows a subtle “swipe” animation that users can easily miss. This lack of obvious visual cues makes Safari users particularly vulnerable to these attacks.

“While the attack works on all browsers, fullscreen BitM attacks are particularly convincing on Safari browsers due to the lack of clear visual cues when going fullscreen,” SquareX researchers noted.

Standard security solutions like EDRs or SASE/SSE fail to detect these attacks since they exploit standard browser APIs rather than malware.

When contacted about this vulnerability, Apple responded with a “wontfix” decision, stating that the existing animation should provide sufficient indication of the mode change.