Vulnerabilities - Apple Fixes WebKit Flaw with Update
Basically, Apple fixed a security flaw that could let bad websites access your data.
Apple has released a vital update to fix a WebKit flaw affecting iPhones, iPads, and Macs. This vulnerability could allow malicious websites to access your data. Users are urged to update their devices to maintain security. Don't risk your personal information—act now!
The Flaw
Apple has rolled out its first Background Security Improvements update to address a significant vulnerability in WebKit, tracked as CVE-2026-20643. This flaw poses a risk by allowing malicious web content to bypass the browser's Same Origin Policy, which is designed to prevent one website from accessing data from another. Discovered by security researcher Thomas Espach, this issue can lead to various security breaches, making it imperative for users to act swiftly.
The vulnerability specifically involves a cross-origin issue in the Navigation API. Apple has tackled this risk by enhancing input validation, thus fortifying the security of its web browsing components. This update is available for devices running iOS 26.3.1, iPadOS 26.3.1, and macOS 26.3.1 and 26.3.2.
What's at Risk
The potential impact of CVE-2026-20643 is substantial, affecting all users of Apple devices that utilize WebKit, which is the underlying engine for the Safari browser. This includes millions of iPhones, iPads, and Macs worldwide. If left unaddressed, the vulnerability could allow attackers to execute malicious scripts or access sensitive user data without consent.
This update marks a significant shift in Apple's approach to security updates. Previously, users had to install a full operating system upgrade to receive security patches. Now, with the introduction of Background Security Improvements, Apple can deliver smaller, targeted updates that can be applied in the background, minimizing disruption to users.
Patch Status
The Background Security Improvements feature was introduced in iOS 26.1, iPadOS 26.1, and macOS 26.1. It allows Apple to push lightweight security updates for critical components like the Safari browser and WebKit framework without requiring a full OS update. Users can find this feature in their device settings under the Privacy & Security menu.
However, it's crucial to note that uninstalling these updates will revert the device to its baseline OS version, eliminating all previous security enhancements. Apple strongly advises against removing these updates unless compatibility issues arise, as doing so could expose devices to significant security risks.
Immediate Actions
To ensure your device remains secure, users should promptly check for and install the latest updates. Here’s how:
- On iPhone and iPad: Go to Settings, then tap Privacy & Security.
- On Mac: From the Apple menu, select System Settings, then click Privacy & Security.
By keeping your device updated, you not only protect your personal data but also contribute to the overall security of the Apple ecosystem. Regularly checking for updates is now more critical than ever, given the evolving landscape of cyber threats.
BleepingComputer