High · published November 4, 2025
⚡ A sneaky website could grab your data without permission! This cross-origin data exfiltration vulnerability in Safari and iOS is no small matter! 🔍 Think of it like a restaurant that allows a stranger to peek at your order — a waiter delivers your meal while a nosy diner at a nearby table takes notes on everything you said. That’s the risk here: a malicious site can access your sensitive information without a proper invitation! An attacker could potentially steal sensitive user data from your device, leading to unauthorized access or identity theft. If you’re on the wrong site, this could be absolutely devastating for your privacy and security!
Think of it like a restaurant that allows a stranger to peek at your order — a waiter delivers your meal while a nosy diner at a nearby table takes notes on everything you said. That’s the risk here: a malicious site can access your sensitive information without a proper invitation! This vulnerability allows a malicious website to bypass cross-origin restrictions, enabling it to read data from another origin without proper authorization. This could lead to the exfiltration of sensitive information from your device.
An attacker could potentially steal sensitive user data from your device, leading to unauthorized access or identity theft. If you’re on the wrong site, this could be absolutely devastating for your privacy and security! To protect yourself, update your Safari and iOS devices to version 26.1 as soon as possible. It’s also a good idea to review your browser settings and consider using additional privacy tools to enhance your security. Don't forget to regularly check for software updates! You've got this! With a quick update, you can keep your data safe and sound. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| apple/safari | < 26.1 | 26.1 |
| apple/ipados | < 26.1 | 26.1 |
| apple/iphone_os | < 26.1 | 26.1 |
| apple/tvos | < 26.1 | 26.1 |
| apple/visionos | < 26.1 | 26.1 |
| apple/watchos | < 26.1 | 26.1 |