CVE-2026-20643
CVSS 5.4 MEDIUM: a cross-origin issue in the Navigation API was addressed with improved input validation. EPSS 0.4% (28th percentile).
Vulnerabilities & Exploits · Web App Attack
Apple released updates for iOS, iPadOS and macOS to fix a WebKit cross‑origin flaw (CVE‑2026‑20643) that could bypass the same‑origin policy. The fix is delivered via a Background Security Improvement for devices running 26.1+ and as iOS/iPadOS 26.3.1(a) and macOS 26.3.1(a)/26.3.2(a).
5 sources · Mar 18
CVSS 5.4 MEDIUM: a cross-origin issue in the Navigation API was addressed with improved input validation. EPSS 0.4% (28th percentile).
SecurityWeek
Apple Debuts Background Security Improvements With Fresh WebKit Patches
The lightweight updates are meant to deliver security protections between security updates.
originalThe Hacker News
Apple Fixes WebKit Vulnerability Enabling Same-Origin Policy Bypass on iOS and macOS
Apple fixes WebKit CVE-2026-20643 in iOS 26.3.1, macOS 26.3.2 using background patches, reducing exploit risk.
originalHelp Net Security
Apple starts issuing lightweight security updates between software releases - Help Net Security
Apple is delivering small security updates, called Background Security Improvements, starting with iOS 26.1, iPadOS 26.1, and macOS 26.1.
originalPart of the PlainSec briefing for 2026-03-23
Every edition of this story: Apple pushes background security fix for WebKit same‑origin bypass