Product:
Safari
Summary
An authorization issue was addressed with improved state management. A maliciously crafted webpage may be able to fingerprint the user. This issue is fixed in Safari 26.4 and other Apple operating systems.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.3 | CVE-2026-20691 |
Exploitation
To exploit this vulnerability, an attacker can create a malicious webpage designed to trick users into visiting it. Once the user interacts with the page, the attacker may be able to gather information about the user’s device and browsing habits through fingerprinting techniques.
Affected Products
- Safari: A web browser that may allow malicious webpages to fingerprint users.
- iOS: The mobile operating system that includes Safari and is affected by this issue.
- iPadOS: The operating system for iPads that also includes Safari and is vulnerable.
- macOS Tahoe: The desktop operating system with Safari that is impacted.
- visionOS: The operating system for Apple Vision devices that may be affected.
- watchOS: The operating system for Apple Watches that includes Safari and is vulnerable.
Mitigation
To mitigate this issue, users should update their Safari browser and other affected Apple operating systems to the latest versions. Regularly updating software can help protect against known vulnerabilities and improve overall security.