Apple WebKit Vulnerability Enables Malicious Web Content Bypass on iOS and macOS

Apple released emergency patches for WebKit vulnerability CVE-2026-20643, a Same Origin Policy bypass in the Navigation API that could let malicious webpages steal authentication tokens, hijack sessions, or exfiltrate data. The fix, credited to researcher Thomas Espach, was deployed via Apple’s Background Security Improvements for iOS 26.3.1, iPadOS 26.3.1, and macOS 26.3.x; users are advised to enable automatic Background Security Improvements to receive protection.