Safari is hot-linking images to semi-random websites

Summary: PortSwigger researcher Gareth Heyes found that Safari's OCR feature parses URLs found in images, so hovering over an image can surface a clickable link - in his case, the Amazon logo on his company homepage produced a link to "Zon.com" because an arrow under the logo broke the OCR. He also found that crafted images could yield clickable JavaScript URLs, which execute in the context of "safari-resource" on refresh, though this requires enabling JavaScript in the Smart search field in the developer menu.
Why it matters: Any image uploaded to any site can embed a URL that Safari presents to your users as clickable, and a crafted image can turn a refresh into JavaScript execution - so image upload paths you treat as harmless content are a delivery channel you may not be inspecting.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026