Collected research

Scratching the surface of host headers in Safari

Linus Särud · Labs Detectify · 4 April 2018

Safari accepts characters in a hostname that other browsers reject, so on sites with wildcard DNS the subdomain itself becomes the injection, reflected into HTML or passed to jQuery html(). Form-attribute payloads with a %0c inside the handler name evade the XSS auditor, and the same flaw in Safari's certificate error page made password manager extensions autofill credentials for the wrong site.

Record

Researcher

Linus Särud

Published by

Labs Detectify

Date

4 April 2018

Topic

HTTP

In the archive

• Collected in the 2018 research round

Tags

• xss
• filter-bypass
• url-parsing
• http
• browser-extension
• dns
• ios
• cve
• bug-bounty
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Linus Särud, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.