Apple fixed a WebKit cross-origin flaw with a silent security update

What happened

A cross-origin flaw in WebKit's navigation API could bypass the same-origin policy. Safari, Mail and the App Store all depended on the affected engine versions.

System components can remain vulnerable even when a user installs no third-party apps.

What was found

A malicious site could potentially read content isolated in another tab or embedded service. Apple delivered the fix silently through Background Security Improvements; no active exploitation was observed.

Data at risk

• Browser tabs
• Embedded content
• Session data
• Safari
• Mail content
• App Store traffic

What you should do

1. 1Confirm the system version shows the security-update suffix.
2. 2Keep automatic and background security updates enabled.
3. 3Install full iOS updates when they become available.