Apple Fixes Critical WebKit Bug on iOS & macOS

Apple Fixes WebKit Vulnerability Enabling Same-Origin Policy Bypass on iOS and macOS

Jeffrey Liu·March 20, 2026·3 min read·2 sources·Consumer Tech

Key Takeaways

1Apple deployed its first "Background Security Improvement" update.
2The update fixes WebKit vulnerability CVE-2026-20643.
3It prevents bypassing the Same Origin Policy on Apple devices.
4These new patches deliver lightweight fixes outside major OS updates.

Apple has quietly rolled out its first-ever "Background Security Improvement" update, iOS 26.3.1 (a), to address a critical WebKit vulnerability. This new patch system delivers lightweight fixes outside of major OS updates, preventing malicious web content from bypassing the browser's Same Origin Policy across iPhones, iPads, and Macs. The move signifies Apple's shift towards more agile security responses, protecting users from immediate web-based threats without the delay of a full system upgrade.

Apple's new Background Security Improvement system delivered its inaugural patch, iOS 26.3.1 (a), to fix a significant WebKit vulnerability, CVE-2026-20643. This update prevents maliciously crafted web content from bypassing the Same Origin Policy on iOS, iPadOS, and macOS devices. It marks a new era for Apple's security patching, focusing on smaller, more frequent updates for critical components like Safari.

Apple's New Approach to WebKit Security

Apple released its first Background Security Improvement update, iOS 26.3.1 (a), on Tuesday, March 17, addressing a critical security flaw in WebKit. This vulnerability, tracked as CVE-2026-20643, affects iOS 26.3.1, iPadOS 26.3.1, macOS 26.3.1, and macOS 26.3.2 [1]. It allowed maliciously crafted web content to bypass the Same Origin Policy (SOP), a fundamental browser security mechanism that prevents websites from interacting with resources from other origins.

The SOP is essential for isolating potentially hostile web pages, stopping a malicious site from accessing sensitive data or performing actions on behalf of a user on another legitimate site. The fix, credited to security researcher Thomas Espach, involves improved input validation within WebKit's Navigation API [1].

This new update system, called Background Security Improvements, represents a notable shift in Apple's patching strategy. Unlike traditional, larger operating system updates, these improvements deliver lightweight security releases for specific components such as the Safari browser and the WebKit framework stack [2]. This allows Apple to push out urgent security fixes more rapidly and continuously, without requiring users to install a full OS upgrade.

Understanding Background Security Improvements

The Background Security Improvements feature is supported and enabled for future releases starting with iOS 26.1, iPadOS 26.1, and macOS 26. This allows for smaller, ongoing security patches between major software updates [2]. This system is analogous to Apple's Rapid Security Response feature, introduced in iOS 16, which also aimed to deliver minor security updates quickly.

Users maintain control over these improvements through the Privacy and Security menu in their device's Settings app. To ensure automatic installation, Apple advises keeping the "Automatically Install" option turned on. Disabling this setting means users will need to wait for these improvements to be included in the next full software update, leaving devices vulnerable for longer.

FAQFrequently Asked Questions

Apple's Background Security Improvement is a new system for delivering lightweight security fixes outside of major OS updates. It allows Apple to quickly address critical vulnerabilities in components like Safari and WebKit without requiring a full system upgrade. This ensures users are protected from immediate web-based threats more rapidly.

The iOS 26.3.1 (a) update, the first delivered via Apple's Background Security Improvement, fixed WebKit vulnerability CVE-2026-20643. This vulnerability allowed maliciously crafted web content to bypass the Same Origin Policy (SOP) on iOS, iPadOS, and macOS devices. The Same Origin Policy is a critical browser security mechanism that prevents websites from interacting with resources from other origins.

Apple's Background Security Improvement protects devices by delivering lightweight security patches for specific components like Safari and WebKit. These patches address vulnerabilities like CVE-2026-20643, which could allow malicious web content to bypass the Same Origin Policy. By applying these fixes quickly, Apple prevents potential exploits and keeps user data secure.

You can manage Background Security Improvements through the Privacy and Security menu in your device's Settings app. Apple recommends keeping the "Automatically Install" option turned on to ensure you receive these critical security patches promptly. If you disable automatic installation, you'll need to wait for the improvements to be included in the next full software update, leaving your device vulnerable for longer.