Apple WebKit Same Origin Policy Bypass Vulnerability

A logic vulnerability in WebKit, the engine powering Safari, was addressed with improved state management. This issue allows a malicious website to access script message handlers meant for other origins, potentially leading to cross-origin information leakage. The vulnerability is present in WebKit components of Safari, iOS, iPadOS, macOS Tahoe, and visionOS, all in version 26.4.

Impact

Exploitation of this vulnerability could lead to cross-origin information leakage, allowing a malicious website to access sensitive data from another origin's script message handlers.