Apple Releases Background Security Improvement for WebKit Flaw CVE-2026-20643

On March 17, 2026, Apple released its first Background Security Improvement to address a critical WebKit vulnerability tracked as CVE-2026-20643. This flaw could allow malicious web content to bypass the Same Origin Policy, potentially exposing user data across different sites. The update applies to devices running iOS 26.3.1, iPadOS 26.3.1, macOS 26.3.1, and macOS 26.3.2. Apple has not disclosed whether the vulnerability has been exploited in the wild. The Background Security Improvement system enables Apple to deliver quick, lightweight patches without requiring a full OS update. Users can manage these updates through the Privacy & Security settings on their devices. The update is significant as it marks a shift in Apple's approach to security, allowing for faster responses to vulnerabilities. The vulnerability was discovered by security researcher Thomas Espach.

Key Points: • Apple's first Background Security Improvement targets CVE-2026-20643 in WebKit. • The flaw allows malicious websites to bypass the Same Origin Policy, risking user data exposure. • The update is available for iOS 26.3.1, iPadOS 26.3.1, macOS 26.3.1, and macOS 26.3.2.