Apple Fixes WebKit Vulnerability Enabling Same-Origin Policy Bypass on iOS and macOS - The Hacker News

Apple Fixes WebKit Vulnerability Enabling Same-Origin Policy Bypass on iOS and macOS Ravie LakshmananMar 18, 2026Vulnerability / Zero-Day Apple on Tuesday released its first round of Background Security Improvements to address a security flaw in WebKit that affects iOS, iPadOS, and macOS. The vulnerability, tracked as CVE-2026-20643 (CVSS score: N/A), has been described as a cross-origin issue in WebKit's Navigation API that could be exploited to bypass the same-origin policy when processing maliciously crafted web content. The flaw affects iOS 26.3.1, iPadOS 26.3.1, macOS 26.3.1, and macOS 26.3.2. It has been addressed with improved input validation in iOS 26.3.1 (a), iPadOS 26.3.1 (a), macOS 26.3.1 (a), and macOS 26.3.2 (a). Security researcher Thomas Espach has been credited with discovering and reporting the shortcoming. Apple notes that Background Security Improvements are meant for delivering lightweight security releases for components such as the Safari browser, WebKit framework stack, and other system libraries through smaller, ongoing security patches rather than issuing them as part of larger software updates. The feature is supported and enabled for future releases starting with iOS 26.1, iPadOS 26.1, and macOS 26. In cases where compatibility issues are discovered, the improvements may be temporarily removed and then enhanced in a subsequent software update, Apple adds. Users can control Background Security Improvements via the Privacy and Security menu in the Settings app. To ensure that they are automatically installed, it's advised to keep the "Automatically Install" option on. It's worth noting that if users opt to have this setting disabled, they will have to wait until the improvements are included in the next software update. Viewed in that light, the feature is analogous to Rapid Security Response, which it introduced in iOS 16 as a way to install minor security updates. "If a Background Security Improvement has been applied, and you choose to remove it, your device reverts to the baseline software update (for example, iOS 26.3) with no Background Security Improvements applied," Apple noted in a help document. The development comes little over a month after Apple issued fixes for an actively exploited zero-day impacting iOS, iPadOS, macOS Tahoe, tvOS, watchOS, and visionOS (CVE-2026-20700, CVSS score: 7.8) that could result in arbitrary code execution. Last week, the iPhone maker also expanded patches for four security flaws (CVE-2023-43010, CVE-2023-43000, CVE-2023-41974, and CVE-2024-23222) that were weaponized as part of the Coruna exploit kit. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share SHARE  Apple, browser security, cybersecurity, iOS, MacOS, Patch Management, Vulnerability, WebKit, zero-day Trending News Microsoft Patches 84 Flaws in March Patch Tuesday, Including Two Public Zero-Days ⚡ Weekly Recap: Chrome 0-Days, Router Botnets, AWS Breach, Rogue AI Agents and More Six Android Malware Families Target Pix Payments, Banking Apps, and Crypto Wallets Android 17 Blocks Non-Accessibility Apps from Accessibility API to Prevent Malware Abuse CISA Flags Actively Exploited Wing FTP Vulnerability Leaking Server Paths Meta to Shut Down Instagram End-to-End Encrypted Chat Support Starting May 2026 OpenClaw AI Agent Flaws Could Enable Prompt Injection and Data Exfiltration Google Fixes Two Chrome Zero-Days Exploited in the Wild Affecting Skia and V8 Apple Issues Security Updates for Older iOS Devices Targeted by Coruna WebKit Exploit Nine CrackArmor Flaws in Linux AppArmor Enable Root Escalation, Bypass Container Isolation FortiGate Devices Exploited to Breach Networks and Steal Service Account Credentials Veeam Patches 7 Critical Backup and Replication Flaws Allowing Remote Code Execution Chinese Hackers Target Southeast Asian Militaries with AppleChris and MemFun Malware Critical n8n Flaws Allow Remote Code Execution and Exposure of Stored Credentials Apple Fixes WebKit Vulnerability Enabling Same-Origin Policy Bypass on iOS and macOS ThreatsDay Bulletin: OAuth Trap, EDR Killer, Signal Phishing, Zombie ZIP, AI Platform Hack and More Load More ▼ Popular Resources Fix Security Noise by Focusing Only on Validated Exposures Webinar - Identify Key Attack Paths to Your Crown Jewels with CSMA Guide - Discover How to Validate AI Risks With Adversarial Testing Get the 2026 ASV Report to Benchmark Top Validation Tools