Loading story…
Apple released its first public Background Security Improvement for iPhones, iPads, and Macs to fix a WebKit vulnerability affecting Safari and other apps that use the browser engine. The update is a lightweight security release delivered outside the normal operating system cycle and is available for supported devices running recent versions of iOS, iPadOS, and macOS. Reports say the patch requires only a quick restart rather than a full traditional OS update, marking the first real-world use of Apple’s renamed background security mechanism after earlier testing.
The flaw, tracked as CVE-2026-20643, stems from WebKit’s implementation of the Navigation API and could allow maliciously crafted web content to bypass the browser’s Same Origin Policy, potentially exposing data from another website in the same browser session. Apple credited a security researcher with finding the issue and did not indicate that the bug had been actively exploited, but the company still pushed the fix ahead of a larger platform release, underscoring the security significance of the vulnerability. The update was published as iOS 26.3.1 (a), iPadOS 26.3.1 (a), macOS 26.3.1 (a), and macOS 26.3.2 (a) for eligible systems.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
By 2026-03-19, reporting indicated Apple had also issued security updates for older iOS and iPadOS versions, including backported fixes for WebKit and kernel vulnerabilities beyond CVE-2026-20643.
On 2026-03-18, the Canadian Centre for Cyber Security published advisory AV26-248, warning that Apple had released security updates for iOS, iPadOS, and macOS and urging users and administrators to review Apple documentation and apply the fixes.
Apple published advisory APPLE-SA-03-17-2026-1 and corresponding support documentation on 2026-03-17, detailing the WebKit vulnerability, affected platforms, and the Background Security Improvements releases that addressed it.
On 2026-03-17, Apple released iOS 26.3.1 (a), iPadOS 26.3.1 (a), macOS 26.3.1 (a), and macOS 26.3.2 (a) to fix CVE-2026-20643, a WebKit Navigation API cross-origin issue that could let malicious web content bypass the Same Origin Policy. Apple credited researcher Thomas Espach and said the flaw was fixed with improved input validation.
Apple made its new Background Security Improvements mechanism available starting with iOS 26.1, iPadOS 26.1, and macOS 26, replacing the earlier Rapid Security Response branding for lightweight out-of-band security fixes.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
16 references tracked. Mallory keeps watching after this page renders.
cnet.com
Open sourcethecyberexpress.com
Open sourcecsirt.sk
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourcetechcrunch.com
Open sourcetidbits.com
Open sourcesupport.apple.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple released security updates for **iOS 26.6.1**, **iPadOS 26.6.1**, **macOS 26.6.2**, **visionOS 26.6.1**, and legacy **iOS/iPadOS 18.7.10**, addressing a broad set of vulnerabilities across supported platforms. Reporting on Apple’s advisories indicates the updates collectively fix more than 100 flaws, with roughly 29 to 30 issues documented for the current-generation iOS, iPadOS, and macOS releases and a much larger set rolled into the backported updates for older devices. Apple said it is not aware of any of the vulnerabilities being actively exploited, but urged users to update because public disclosure raises the risk of attacks against unpatched systems. The patched issues span **WebKit**, the kernel, **ImageIO**, **CoreAudio**, **APFS**, **Telephony**, Wi‑Fi, Contacts, and other components, with impacts including arbitrary code execution, information disclosure, denial of service, memory corruption, sandbox escape, and cross-origin data exfiltration. One notable iOS flaw in `Telephony` could allow an attacker in a privileged network position to bypass **IPsec** authentication and intercept traffic, while Apple’s documentation also lists numerous WebKit bugs and an image-based code execution issue. Several findings were credited to AI-assisted security research, including nine CVEs attributed to **OpenAI Codex Security**, and Apple said some visionOS vulnerability details would be published separately.
Aug 31, 2026
Apple released security updates for **Safari, iOS, iPadOS, and macOS** to fix more than 30 vulnerabilities, including the high-severity Safari/WebKit flaw **`CVE-2026-43715`**, a remotely exploitable use-after-free bug triggered by maliciously crafted web content. Apple said the issue could lead to memory corruption and addressed it with improved memory management in **Safari 26.5.2**, **iOS 26.5.2**, **iPadOS 26.5.2**, and **macOS Tahoe 26.5.2**; the flaw carries a **CVSS 8.8** rating. The broader patch set also remediates additional WebKit and kernel vulnerabilities that could cause crashes, sensitive data exposure, sandbox escape, and kernel memory corruption. Apple said none of the flaws were known to be exploited in the wild, but it is accelerating patch delivery because AI-assisted research may shorten the gap between vulnerability discovery and weaponization; several of the WebKit bugs were identified with help from **OpenAI Codex Security** and researchers using **Anthropic Claude**.
Aug 24, 2026
Apple released **Safari 26.5** for macOS Sonoma and macOS Sequoia to fix multiple vulnerabilities in **WebKit** and **WebRTC** that could be triggered by malicious web content. The flaws could allow **Content Security Policy bypass**, disclosure of sensitive user information, access to sensitive user data, misuse of another website’s download settings through a malicious iframe, and application or process crashes. Apple attributed the issues to validation, access control, UI handling, memory handling, and use-after-free weaknesses, and credited a broad set of external researchers and organizations for the findings. Apple also shipped updates for older devices—**iOS 16.7.16**, **iPadOS 16.7.16**, **iPadOS 17.7.11**, and **iOS/iPadOS 15.8.8**—to address **`CVE-2026-28950`** in Notification Services. The bug could cause notifications marked for deletion to remain on a device because of a logging issue, creating a privacy and data-handling risk; Apple said it resolved the problem through improved data redaction. Canada’s Cyber Centre urged users and administrators to review Apple’s advisories and apply the updates, including upgrading Safari systems to **26.5 or later**.
Jun 29, 2026