$ 0 0 A flaw in Safari - that allows an attacker to spoof websites and trick victims into handing over their credentials - has yet to be patched.