Apple WebKit Cross-Origin Data Exfiltration Vulnerability

A vulnerability in WebKit, the engine used by Safari, allows cross-origin data exfiltration. This issue is present in WebKit components of Safari, visionOS, watchOS, iOS, iPadOS, and tvOS, all through version 26.0. The vulnerability arises because a malicious website can exploit this flaw to access and exfiltrate data from other origins, potentially leading to privacy breaches.

Impact

Exploitation of this vulnerability could result in unauthorized cross-origin data exfiltration, compromising user privacy by allowing malicious websites to access sensitive information from other sites.

Remediation

Users can update to Safari 26.1, or the respective 26.1 versions of visionOS, watchOS, iOS, iPadOS, or tvOS, depending on their device.