F-Secure SAFE Browser for iOS Vulnerable to Address Bar Spoofing

More information

A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Linux Security whereby the FSAVD component used in certain F-Secure products can crash while scanning larger packages/fuzzed files. The exploit can be triggered remotely by an attacker. A successful attack will result in Denial-of-Service (DoS) of the antivirus engine.

This issue was reported to F-Secure through the Vulnerability Reward Program. No known exploit or attack has been seen in the wild.


F-Secure Corporation would like to thank following person for bringing this issue to our attention.

Narendra Bhati



  • F-Secure SAFE Browser is vulnerable to address bar spoofing.
  • Status

  • Resolved
  • Risk level

  • Medium
  • Fix

  • Upgrade to version 18.4.x or newer from the App Store
  • Affected products

  • Corporate Products: F-Secure SAFE Browser Version 18.3.x and below
  • Platforms

  • iOS
  • Date issues

  • 11/8/2021
  • Security advisories
  • 2021
  • Medium