A cross-origin issue in the Navigation API was addressed with improved input validation. This issue is fixed in Background Security Improvements for iOS 26.3.1, iPadOS 26.3.1, macOS 26.3.1, and macOS 26.3.2. Processing maliciously crafted web content may bypass Same Origin Policy.
References
| Link | Resource |
|---|---|
| https://support.apple.com/en-us/126604 | Release Notes Vendor Advisory |
| http://seclists.org/fulldisclosure/2026/Mar/10 |
Configurations
Configuration 1 (hide)
|
History
19 Mar 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
18 Mar 2026, 20:10
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* |
|
| References | () https://support.apple.com/en-us/126604 - Release Notes, Vendor Advisory | |
| First Time |
Apple macos
Apple Apple iphone Os Apple ipados |
18 Mar 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
| CWE | CWE-346 CWE-20 |
17 Mar 2026, 23:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-17 23:16
Updated : 2026-03-19 17:16
NVD link : CVE-2026-20643
Mitre link : CVE-2026-20643
CVE.ORG link : CVE-2026-20643
JSON object : View
Products Affected
apple
- iphone_os
- ipados
- macos