Loading story…
Apple patched CVE-2016-4585, a WebKit page-loading vulnerability in Safari that allowed remote attackers to inject arbitrary script or HTML through specially crafted HTTP redirections. The flaw affected Safari before 9.1.2, iOS before 9.3.3, and tvOS before 9.2.2, and stemmed from improper handling of redirect targets with malformed, non-numeric ports. Researchers showed Safari could send invalid Host headers after following such redirects, creating exploitable conditions in web applications that reflected the header into pages, scripts, links, forms, anchors, or subsequent Location values.
The research also described an origin confusion condition in which pages reached through the malformed redirect could execute in a broken security context. When combined with an iframe, relative resources from a target page could be resolved against an attacker-controlled site, enabling cross-site scripting, spoofing, information theft, and possible content exfiltration or alteration under specific application conditions. Apple addressed the issue by tightening redirect URL validation so invalid redirection URLs trigger an error instead of being processed.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
The CVE record for CVE-2016-4585 was updated. The record notes the update date and retains references to Apple advisories and related third-party material.
A public research write-up detailed how malformed redirect URLs could cause Safari to send invalid Host headers and create a broken-origin condition, enabling XSS or information theft under certain application conditions. The disclosure also documented iframe-based exploitation and Apple's validation-based fix behavior.
The CVE record for CVE-2016-4585 was published, describing a WebKit Page Loading cross-site scripting vulnerability in Safari, iOS, and tvOS triggered by mishandled HTTP redirections. The entry identified Apple as the CNA and linked Apple advisories and third-party references.
Apple fixed the vulnerability by strengthening validation of redirect URLs so invalid redirect targets produce an error page. The affected products were Safari before 9.1.2, iOS before 9.3.3, and tvOS before 9.2.2, and users were advised to upgrade to versions released on or after July 18, 2016.
The Safari URL handling vulnerability later assigned CVE-2016-4585 was reported to Apple and Japan's IPA in September 2015. The flaw involved crafted redirect URLs that could enable Host header manipulation and origin-confusion-based XSS.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
cve.mitre.org
Open sourcesupport.apple.com
Open sourcesupport.apple.com
Open sourcembsd.jp
Open sourcembsd.jp
Open sourcecve.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple released **Safari 26.4** and **Xcode 26.4** security updates to address multiple vulnerabilities affecting macOS systems. The Safari update for **macOS Sonoma** and **macOS Sequoia** fixes seven `CVE`-tracked issues in **WebKit** and **WebKit Sandboxing** that could enable **Content Security Policy** and **Same Origin Policy** bypasses, **cross-site scripting**, process crashes, cross-origin access to script message handlers, improper processing of restricted web content, and user fingerprinting. Apple said the flaws were mitigated through improved state management, input validation, logic checks, memory handling, and authorization controls. The **Xcode 26.4** advisory covers two vulnerabilities on systems running **macOS Tahoe 26.2 and later**. Apple patched an out-of-bounds read in `otool` (`CVE-2026-28890`) that could let an app trigger an unexpected system termination, and a permissions flaw in **Simulator** (`CVE-2026-28889`) that could allow an app to read arbitrary files as **root**. Apple credited external researchers for the findings and made the updates available through the **Mac App Store**, developer download channels, and its security releases pages.
Jun 29, 2026
Apple released security updates for **Safari, iOS, iPadOS, and macOS** to fix more than 30 vulnerabilities, including the high-severity Safari/WebKit flaw **`CVE-2026-43715`**, a remotely exploitable use-after-free bug triggered by maliciously crafted web content. Apple said the issue could lead to memory corruption and addressed it with improved memory management in **Safari 26.5.2**, **iOS 26.5.2**, **iPadOS 26.5.2**, and **macOS Tahoe 26.5.2**; the flaw carries a **CVSS 8.8** rating. The broader patch set also remediates additional WebKit and kernel vulnerabilities that could cause crashes, sensitive data exposure, sandbox escape, and kernel memory corruption. Apple said none of the flaws were known to be exploited in the wild, but it is accelerating patch delivery because AI-assisted research may shorten the gap between vulnerability discovery and weaponization; several of the WebKit bugs were identified with help from **OpenAI Codex Security** and researchers using **Anthropic Claude**.
Aug 24, 2026
Apple and Red Hat disclosed **CVE-2026-43725**, an improper input validation flaw in WebKit and WebKitGTK that allows a malicious website to cause restricted web content to be processed outside the browser sandbox. Red Hat rates the issue **Important** with a **CVSS v3.1 score of 7.1** and maps it to `CWE-20`, warning that successful exploitation could affect confidentiality, integrity, and availability by exposing restricted resources. The vulnerability was addressed through improved input validation and fixed across Apple platforms including Safari, iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS, while Red Hat published remediation through multiple advisories for supported **RHEL 7, 8, and 9** offerings. Red Hat's Bugzilla tracking links the issue to **WebKit bug 312832** and **WebKitGTK advisory `WSA-2026-0004`**, and notes that **RHEL 6** packages are outside support scope and should be assumed affected.
Aug 24, 2026