CVE-2013-6835 in iOS
Summary
by MITRE
TelephonyUI Framework in Apple iOS 7 before 7.1, when Safari is used, does not require user confirmation for FaceTime audio calls, which allows remote attackers to obtain telephone number or e-mail address information via a facetime-audio: URL.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 05/08/2026
The vulnerability described in CVE-2013-6835 represents a significant security flaw in Apple iOS 7 versions prior to 7.1 within the TelephonyUI Framework component. This issue specifically affects the interaction between Safari web browser and FaceTime audio calling functionality, creating an unintended privilege escalation scenario that bypasses normal user consent mechanisms. The flaw stems from the framework's failure to properly validate and authenticate incoming FaceTime audio call requests initiated through web-based URLs, particularly those formatted as facetime-audio: URIs.
The technical implementation of this vulnerability resides in the improper handling of URI schemes within the iOS telephony framework. When a user navigates to a webpage containing a facetime-audio: URL, the system should require explicit user confirmation before initiating any audio call attempt. However, the vulnerable iOS 7 implementation fails to enforce this confirmation step, allowing malicious web pages to automatically trigger FaceTime audio calls without user awareness. This behavior creates a dangerous precedent where remote attackers can exploit web-based vectors to gather sensitive information including telephone numbers and email addresses through the automatic call initiation process.
The operational impact of this vulnerability extends beyond simple unauthorized call initiation, as it enables information gathering through the automatic disclosure of user contact information. Attackers can craft malicious web pages that contain embedded facetime-audio: URLs, which when visited by victims, automatically attempt to call the user's phone number or email address associated with their FaceTime account. This creates a reconnaissance vector where adversaries can harvest contact information without user knowledge or consent, potentially enabling further social engineering attacks or targeted phishing campaigns. The vulnerability particularly affects users who have FaceTime enabled and have associated their phone numbers or email addresses with their accounts.
From a cybersecurity perspective, this vulnerability aligns with CWE-352, which describes Cross-Site Request Forgery (CSRF) conditions where legitimate requests are executed without user consent. The flaw also demonstrates characteristics of CWE-20, representing improper input validation where the system fails to properly validate the source and intent of incoming URI requests. The attack pattern follows ATT&CK technique T1566, specifically focusing on credential access through social engineering techniques that exploit user trust in web browsers and communication applications. The vulnerability's exploitation requires minimal technical skill and can be executed through simple web page construction, making it particularly dangerous in mass phishing or campaign scenarios.
Mitigation strategies for this vulnerability involve immediate system updates to iOS 7.1 or later versions where Apple has implemented proper user confirmation prompts for FaceTime audio calls initiated through web-based URLs. Organizations should also implement network-level controls to monitor and restrict access to potentially malicious websites, particularly those known to host phishing content or exploit kits. Security awareness training for end users remains critical, emphasizing the importance of verifying website authenticity before clicking on embedded links or visiting untrusted web pages. Additionally, users should consider disabling FaceTime functionality when not actively needed or configure their systems to require explicit confirmation for all incoming audio call requests, regardless of the originating source.