Apple WebKit Cross-Origin Navigation API Vulnerability Bypassing Same Origin Policy

A cross-origin vulnerability in the Navigation API of WebKit has been identified, allowing maliciously crafted web content to bypass the Same Origin Policy. This issue affects multiple Apple operating systems, including iOS, iPadOS, and macOS, all in version 26.3.1 or 26.3.2. The vulnerability was addressed with improved input validation.

Impact

Exploitation of this vulnerability could lead to a cross-origin issue, allowing web content to bypass the Same Origin Policy, which could be exploited to access or manipulate data from another origin.

Remediation

Users can update to the latest versions of iOS, iPadOS, and macOS to address this vulnerability. The specific versions to update to are iOS 26.3.1, iPadOS 26.3.1, macOS 26.3.1, and macOS 26.3.2.