Back Thehackernews

Apple Fixes WebKit Vulnerability Enabling Same

Thehackernews •[email protected] (The Hacker News) • March 18, 2026

Apple on Tuesday released its first round of Background Security Improvements to address a security flaw in WebKit that affects iOS, iPadOS, and macOS. The vulnerability, tracked as CVE-2026-20643 (CVSS score: N/A), has been described as a cross-origin issue in WebKit's API that could be exploited to bypass the same-origin policy when processing maliciously crafted web content. The

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Apple Releases Background Security Improvement for WebKit Flaw CVE-2026-20643 On March 17, 2026, Apple released its first Background Security Improvement to address a critical WebKit vulnerability tracked as CVE-2026-20643. This flaw could allow malicious web content to bypass the Same Origin Policy, potentially exposing user data across different sites. The update applies to devices running iOS 26.3.1, iPadOS 26.3.1, macOS 26.3.1, and macOS 26.3.2. Apple has not disclosed whether the vulnerability has been exploited in the wild. The Background Security Improvement system enables Apple to deliver quick, lightweight patches without requiring a full OS update. Users can manage these updates through the Privacy & Security settings on their devices. The update is significant as it marks a shift in Apple's approach to security, allowing for faster responses to vulnerabilities. The vulnerability was discovered by security researcher Thomas Espach. 22 sources 58

Extracted Entities

CVEs (1)

CVE-2026-20643

Platforms (4)

IOS IPadOS MacOS WebKit