CVE-2008-5914
An unspecified function in the JavaScript implementation in Apple Safari creates and exposes a ...
An unspecified function in the JavaScript implementation in Apple Safari creates and exposes a "temporary footprint" when there is a current login to a web site, which makes it easier for remote attackers to trick a user into acting upon a spoofed pop-up message, aka an "in-session phishing attack." NOTE: as of 20090116, the only disclosure is a vague pre-advisory with no actionable information. However, because it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes.
Exploit likelihood
What each source reports
NVD Score used
An unspecified function in the JavaScript implementation in Apple Safari creates and exposes a "temporary footprint" when there is a current login to a web site, which makes it easier for remote attackers to trick a user into acting upon a spoofed pop-up message, aka an "in-session phishing attack." NOTE: as of 20090116, the only disclosure is a vague pre-advisory with no actionable information. However, because it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes.
- Record
CVE-2008-5914- CVSS 2.0
- 2.1 Low
AV:N/AC:H/Au:S/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
An unspecified function in the JavaScript implementation in Apple Safari creates and exposes a "temporary footprint" when there is a current login to a web site, which makes it easier for remote attackers to trick a user into acting upon a spoofed pop-up message, aka an "in-session phishing attack." NOTE: as of 20090116, the only disclosure is a vague pre-advisory with no actionable information. However, because it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes.
- Record
CVE-2008-5914- Updated
- 2026-11-02
EUVDEUVD-2008-5884 No score
An unspecified function in the JavaScript implementation in Apple Safari creates and exposes a "temporary footprint" when there is a current login to a web site, which makes it easier for remote attackers to trick a user into acting upon a spoofed pop-up message, aka an "in-session phishing attack." NOTE: as of 20090116, the only disclosure is a vague pre-advisory with no actionable information. However, because it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes.
- Record
EUVD-2008-5884- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p39m-69jw-xg87 No score
An unspecified function in the JavaScript implementation in Apple Safari creates and exposes a ...
An unspecified function in the JavaScript implementation in Apple Safari creates and exposes a "temporary footprint" when there is a current login to a web site, which makes it easier for remote attackers to trick a user into acting upon a spoofed pop-up message, aka an "in-session phishing attack." NOTE: as of 20090116, the only disclosure is a vague pre-advisory with no actionable information. However, because it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes.
- Record
GHSA-p39m-69jw-xg87- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-5914 is a low vulnerability (CVSS 2.1) in Apple Safari, published January 20, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.87%, the 59th percentile. No source names a fixed version.
References
infoworld.com/article/09/01/13/Browser_bug_could_allow_phishing_without_email_1.html
darkreading.com/security/attacks/showArticle.jhtml?articleID=212900161
arstechnica.com/news.ars/post/20090113-new-method-of-phishmongering-could-fool-experienced-users.html
trusteer.com/files/In-session-phishing-advisory-2.pdf
securityfocus.com/bid/33276
nvd.nist.gov/vuln/detail/CVE-2008-5914
github.com/advisories/GHSA-p39m-69jw-xg87