Apple Fixes Web Kit Vulnerability Enabling Same-Origin Policy Bypass on iOS and macOS
Summary: Apple released its first Background Security Improvements on Tuesday to fix a WebKit cross-origin issue in the Navigation API, tracked as CVE-2026-20643, that could bypass the same-origin policy when processing maliciously crafted web content. The flaw affects iOS 26.3.1, iPadOS 26.3.1, macOS 26.3.1, and macOS 26.3.2, and was addressed with improved input validation in the (a) releases; researcher Thomas Espach is credited with reporting it.
What's compelling: This is the first outing for a delivery mechanism Apple built to patch Safari and WebKit outside full OS updates, and users who turn off "Automatically Install" in Settings will not receive it until the next regular software update.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-41974CVE-2023-43000CVE-2023-43010CVE-2024-23222CVE-2026-20643CVE-2026-20700
- Related
- CVE-2023-41974: Apple iOS and iPadOS Use-After-Free Vulnerability Known Exploited Vulnerabilities · Mar 05, 2026CVE-2023-43000: Apple Multiple products Use-After-Free Vulnerability Known Exploited Vulnerabilities · Mar 05, 2026