Everyone says not to click on "malicious URLs". Are there any attacks where the URL itself, rather than the resource accessed by the URL, is the attack vector?

  • Yep! (The same thing happened more recently with the custom protocol handler dialog in Safari on Mac OS X, but I haven’t been able to find it.)
    – Ry-
    Oct 31, 2014 at 19:44

1 Answer 1


Actually this is very timely as there's a relatively new attack where the data passed in the URL is the attack vector.

Reflected File Download abuses non-malicious servers by passing them malicious data and then having it reflected back to users, so it appears to the user to have come from a "trusted" source.

  • just read the paper; first impression: "will this ever end?" Oct 31, 2014 at 8:08
  • 1
    Is RFD attacks still reproducible on OSX Chome? I just tried and can't get it to work.
    – MD6380
    Dec 7, 2016 at 2:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .