Apple pushes first Background Security Improvements update to fix WebKit flaw

Apple released a Background Security Improvements update to fix WebKit vulnerability CVE-2026-20643, a Navigation API cross-origin issue that could bypass the browser Same Origin Policy; the fix (improved input validation) is available via iOS 26.3.1, iPadOS 26.3.1, macOS 26.3.1 and macOS 26.3.2. The update was delivered through Apple's new out-of-band Background Security Improvements feature and was credited to researcher Thomas Espach; Apple notes uninstalling background updates reverts devices to the baseline OS without incremental patches.