The attack stems from a glitch in WebKit, an HTML layout browser engine in Apple’s Safari browser.
Source: Threadpost