Product:
Safari
Summary
This issue was addressed through improved state management. A website may be able to track users through Safari web extensions. The issue is fixed in iOS 26.3, iPadOS 26.3, macOS Tahoe 26.3, and visionOS 26.3.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.3 | CVE-2026-20676 |
Exploitation
An attacker can exploit this vulnerability by creating a malicious website that utilizes Safari web extensions to track users without their consent. By leveraging the state management issue, the attacker can gather user data and potentially compromise user privacy.
Affected Products
- iOS 26.3: Mobile operating system for iPhone and iPad devices.
- iPadOS 26.3: Operating system specifically designed for iPad devices.
- macOS Tahoe 26.3: Operating system for Mac computers.
- visionOS 26.3: Operating system for Apple Vision devices.
Mitigation
To mitigate this issue, users should update their devices to the latest versions of iOS, iPadOS, macOS, and visionOS. Regularly updating software helps protect against vulnerabilities and enhances security.