CVE-2026-20643 is a medium-severity cross-origin vulnerability found in the Navigation API, affecting Apple iOS, iPadOS, and macOS, including Safari. This flaw allows maliciously crafted web content to bypass the Same Origin Policy, potentially leading to unauthorized access to limited data or modification. The attack requires user interaction and can be executed over the network with low complexity, resulting in low confidentiality and integrity impacts. While there are no public exploits available and it is not listed on CISA's KEV catalog, the vulnerability has received significant community discussion and media coverage, notably being addressed through Apple's new Background Security Improvements.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 26.3.1CPE matchmatch criteria | cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* | ||
< 26.3.1CPE matchmatch criteria | cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* | ||
< 26.3.1CPE matchmatch criteria | cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
WebKitGTK vulnerabilities
May 6, 2026About the security content of iOS 26.4 and iPadOS 26.4 - Apple Support
About the security content of iOS 18.7.7 and iPadOS 18.7.7 - Apple Support
About the security content of Background Security Improvements for iOS 26.3.1, iPadOS 26.3.1, macOS 26.3.1, and macOS 26.3.2 - Apple Support
About the security content of visionOS 26.4 - Apple Support
About the security content of Safari 26.4 - Apple Support
About the security content of macOS Tahoe 26.4 - Apple Support