Safari, Chrome hit by address bar spoofing bugs