CVE-2016-1728 in Safari
Summary
by MITRE
The Cascading Style Sheets (CSS) implementation in Apple iOS before 9.2.1 and Safari before 9.0.3 mishandles the "a:visited button" selector during height processing, which makes it easier for remote attackers to obtain sensitive browser-history information via a crafted web site.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/06/2022
The vulnerability described in CVE-2016-1728 represents a significant information disclosure flaw within Apple's web rendering engine that affected iOS and Safari browsers prior to specific security updates. This issue resides in the CSS implementation where the browser's handling of the "a:visited button" selector during height processing creates an unintended mechanism for attackers to infer user browsing history. The vulnerability specifically impacts versions of iOS before 9.2.1 and Safari before 9.0.3, representing a critical privacy concern that could be exploited through malicious web content.
The technical flaw exploits a known security pattern where CSS properties can be manipulated to reveal information about a user's browsing history through visual inspection techniques. When processing the "a:visited button" selector, the affected browsers fail to properly isolate the height calculations for visited links, creating a side-channel attack vector. This occurs because CSS allows for the manipulation of element dimensions based on link visitation status, and the improper height processing creates detectable visual differences that can be measured and analyzed. The vulnerability falls under CWE-200, which specifically addresses "Information Exposure Through Side Channels" and aligns with ATT&CK technique T1056.001 for "Input Injection" through CSS-based information leakage.
The operational impact of this vulnerability extends beyond simple privacy concerns to potentially enable sophisticated tracking mechanisms that could compromise user confidentiality. Attackers can craft malicious websites that observe subtle differences in element heights to determine which links a user has visited, effectively creating a history-based tracking system without requiring direct access to the user's browsing data. This type of attack could be particularly dangerous in environments where sensitive browsing patterns might reveal personal information, political affiliations, medical conditions, or other confidential data. The vulnerability's exploitation requires no special privileges and can be executed through standard web browsing, making it a significant threat to user privacy and security.
Mitigation strategies for this vulnerability include immediate application of Apple's security updates, specifically iOS 9.2.1 and Safari 9.0.3, which address the CSS processing inconsistency. Security professionals should also implement network-level protections such as content filtering and web application firewalls that can detect and block suspicious CSS patterns. Browser hardening techniques including disabling CSS-based visual features and implementing strict privacy controls can further reduce the attack surface. Organizations should conduct regular security assessments to ensure proper patch management and monitor for similar vulnerabilities in other browser components that might create additional side-channel attack vectors. The incident underscores the importance of proper CSS implementation in web browsers and highlights the need for comprehensive security testing of rendering engines to prevent information leakage through seemingly innocuous visual processing features.