CVE-2008-1999: Apple Safari 3.1.1 allows remote attackers to spoof the address bar by placing many "invisible" characters...

Security readout for executives and security teams

This CVE describes an address-bar spoofing issue in Apple Safari 3.1.1. A malicious URL could use many invisible characters in the userinfo part of the address to make the browser display a misleading location. The main business risk is phishing and user deception, not direct system takeover based on the supplied sources. Exposure is most likely limited to environments where obsolete Safari 3.1.1 is still used or test images retain it. Modern supported Safari versions are not identified as affected in the supplied bundle. Prioritize as a legacy exposure and phishing-control issue. It is not supported by the bundle as actively exploited or code-execution capable, but any remaining Safari 3.1.1 use should be removed because the product is obsolete. Mitigation focus: Inventory endpoints for Safari 3.1.1 or similarly obsolete Safari builds.; Move users to supported browser versions following Apple guidance.; Check vendor advisories for the official fix history before asserting patch status..

Prepared

Jun 28, 2026, 19:09 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.