Collected research

PermissionJacking: How a Subtle Bug in Safari Could Lead to Camera Hijacking

RenwaX23 · GitHub

Safari on macOS leaves camera, microphone and location prompts clickable while the window is unfocused, so one click reaches Allow. Two clickjacking methods hide the prompt under a pop-up: one flickers the pop-up size on hover so the Allow button is never clearly visible, the other closes it on the first press of a double-click.

Record

Researcher

RenwaX23

Published by

GitHub

Format

Code

Topic

Identity

In the archive

• Collected in the 2025 research round

Tags

• clickjacking
• ui-redress
• race-condition
• javascript
• dom
• case-study
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of RenwaX23, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 14 August 2026.