Ao you Browser Remote direct unauthorized operation
Ao you browser for iphone or ipad (when ipad has phone functions)
When it accesses the following webpage:
<Html> <iframe src = "tel: 10086"> </iframe>
Most normal browsers I tested will prompt you if you want to make a call, for example:
However, the browser has no prompt to directly jump to the phone call. You can think about how serious the problem may be if the attacker is not setting 10086 but a paid number!
Difficult, but the effect is:
Solution:
Because most browsers do not have this vulnerability, you can determine that this vulnerability is caused by your own code.
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
