The issue - present in Webkit - is technically a cross-domain vulnerability, meaning that an attacker could rig web content to bypass some of the normal cross-domain restrictions when a user views it. The attacker could then use that access to modify HTTP cookies on a website.

The problem, according to the researcher who found the issue, Jouko Pynnonen of the Finnish firm Klikki Oy, lies in the way that Safari previously handled its FTP URL scheme. Klikki Oy, which has found a handful of other bugs over the last several months, including a critical XSS vulnerability in WordPress, notified Apple of the bug on January 27.

The browser allows HTML documents to be accessed via URLs beginning with ftp:// - like ftp://user:password. This can be an issue when encoded characters are used in place of the password however, according to Pynnönen, who says that in some cases the URL could be misinterpreted to come from an attacker's site and not the target site.