Abstract

Browser is a perpetual topic in the field of Cyber Security, and what we are witnessing today is a more mature and somewhat less-fluctuating browser market. According to the latest market statistics report, Safari is the second most popular browser behind Chrome. The main part of this presentation will focus on the "Safari Adventure", we'll take a deep dive into Safari internals and explain different kind of attack vectors campaign targeting multiple components, such as User-Interface, Security-Feature, Just-in-time compiler, and SafariServices framework. Specifically, I am going to illustrate how I found 6+ CVEs in Safari within one year.