Product:
Navigation API
Summary
A cross-origin issue in the Navigation API was addressed with improved input validation. Processing maliciously crafted web content may bypass Same Origin Policy. This issue is fixed in Background Security Improvements for iOS, iPadOS, and macOS.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.4 | CVE-2026-20643 |
Exploitation
An attacker can exploit this vulnerability by crafting malicious web content that is designed to bypass the Same Origin Policy. This requires the user to interact with the malicious content, which could lead to unauthorized access to sensitive information or actions on behalf of the user.
Affected Products
- iOS 26.3.1: Background Security Improvements addressing cross-origin issues.
- iPadOS 26.3.1: Security enhancements to prevent Same Origin Policy bypass.
- macOS 26.3.1: Fixes for cross-origin vulnerabilities in the Navigation API.
- macOS 26.3.2: Additional security improvements related to the Navigation API.
Mitigation
To mitigate this vulnerability, users should update their devices to the latest versions of iOS, iPadOS, and macOS as specified in the security improvements. Regularly applying updates can help protect against potential exploits.