Apple Fixes WebKit Vulnerability Enabling Same-Origin Policy Bypass on iOS and macOS

Apple released Background Security Improvements to address a WebKit Navigation API cross-origin bypass vulnerability (CVE-2026-20643) affecting iOS, iPadOS, and macOS; the flaw could bypass the same-origin policy when processing malicious web content and has been patched via improved input validation in iOS 26.3.1, iPadOS 26.3.1, macOS 26.3.1, and macOS 26.3.2. The change is delivered through Apple’s lightweight Background Security Improvements mechanism, which users can control via Privacy & Security settings, and the report notes related recent patches and a credited security researcher.