Apple has released critical security patches to address a high-severity WebKit vulnerability that allows maliciously crafted web content to bypass the Same Origin Policy.

Released on March 17, 2026, these updates apply to the latest versions of Apple’s mobile and desktop operating systems.

The patch is delivered through the Background Security Improvements mechanism, ensuring devices receive rapid protection without requiring a lengthy system reboot or a major software update installation.

Apple WebKit Vulnerability CVE-2026-20643

Discovered and reported by security researcher Thomas Espach, the vulnerability is officially tracked as CVE-2026-20643. The flaw originates from a cross-origin issue within the Navigation API of the WebKit framework stack.

Under normal circumstances, the Same Origin Policy acts as a fundamental security boundary in modern web browsers. It restricts how a document or script loaded by one origin can interact with resources from another origin.

When threat actors successfully bypass this mechanism using maliciously crafted web content. They can potentially steal authentication tokens, hijack user sessions, or exfiltrate private information from trusted websites the victim is currently visiting.

Apple engineers addressed the underlying Navigation API weakness by implementing improved input validation, successfully closing the loophole that allowed improper cross-origin navigation.

Rather than waiting for the next major software release, Apple distributed this fix as a Background Security Improvement.

Introduced with the 26.1 operating system versions, these lightweight updates deliver crucial security protections for components like the Safari browser, the WebKit framework stack, and various system libraries.

This rapid-response system allows Apple to patch highly severe vulnerabilities seamlessly between standard update cycles.

If a user experiences rare compatibility issues after a patch is applied, they can temporarily remove the improvement.

Doing so reverts the device to the baseline software update until the patch is formally enhanced and integrated into a subsequent major release.

The rapid updates apply specifically to iOS 26.3.1, iPadOS 26.3.1, macOS 26.3.1, and macOS 26.3.2. To ensure devices remain protected against this WebKit vulnerability, users should verify that their settings are configured to accept ongoing patches automatically.

Users can manage these configurations by navigating to the Privacy & Security menu in their device settings.

On iPhones and iPads, this is located directly in the main Settings app. At the same time, Mac users can access it through System Settings via the Apple menu.

From there, selecting the Background Security Improvements option allows users to confirm that the “Automatically Install” feature is turned on.

Turning off this setting leaves devices vulnerable to cross-origin attacks until a standard software update is manually installed.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.