The issue was addressed by adding additional logic. This issue is fixed in Safari 26, macOS Tahoe 26. Visiting a malicious website may lead to address bar spoofing.
No PoCs from references.
- https://github.com/RenwaX23/Address_Bar_Spoofing