Apple Safari exposes users to fullscreen browser-in-the-middle attacks

SquareX researchers describe a weakness in Safari's handling of the Fullscreen API that enables fullscreen browser-in-the-middle (BitM) attacks: attackers can open a remote, attacker-controlled browser (via tools like noVNC), activate a fullscreen window that covers the address bar and other guardrails, and harvest credentials when victims log in. Chromium and Firefox show fullscreen warnings that can mitigate the risk, but Safari lacks a clear alert, increasing the likelihood of successful credential theft; SquareX reported the issue to Apple and received a "wontfix" response.