Loading vulnerability…
User Fingerprinting via WebKit Sandboxing Authorization Flaw
CVE-2026-20691 is an authorization vulnerability in WebKit Sandboxing that may allow a maliciously crafted webpage to fingerprint the user. The issue was addressed through improved state management. It affects Apple WebKit-based products and WebKitGTK and WPE WebKit versions before 2.52.1. The specific vulnerable function and fingerprinting mechanism have not been disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation may compromise user privacy by enabling webpage-based fingerprinting, potentially supporting user recognition or tracking. The specific attributes exposed and the reliability or persistence of the resulting fingerprint are not disclosed.
If you can’t patch tonight, do this now.
Until patches can be applied, reduce exposure by limiting use of untrusted web content in affected WebKit-based browsers and embedded WebKit applications. Enterprise defenders can lower risk by restricting browsing to trusted sites, disabling or minimizing active web content where operationally feasible, and using browser isolation or similar containment controls for high-risk browsing. These measures only reduce exposure and do not fully remediate the underlying authorization flaw.
Patch, then assume compromise.
Install Safari 26.4, iOS 26.4, iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4, or watchOS 26.4, as applicable, or a later supported release. For WebKitGTK and WPE WebKit, upgrade to version 2.52.1 or later. These updates address the authorization issue through improved state management.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.