#Apple safari alert iphone plus
#Apple safari alert iphone free

Exploiting the Safari 15 Browser BugĪchieving a leak does not require any specific user action beyond visiting a malicious website, researchers warned. That makes the use of any stolen credentials that much more dangerous. Put simply, malicious websites can learn a user’s identity and link it to multiple separate accounts that use the same ID (Gmail, Google Calendar, Google Keep, YouTube, Google Docs and so on, to continue the Google example), researchers warned. This includes, for example, your Google profile picture, which can be looked up using an ID attached to certain sites’ IndexedDB caches.” They added, “authenticated users can be uniquely and precisely identified. This ID can be retrieved using this leak as well,” Malwarebytes researchers explained. “Google services store an IndexedDB instance for each of your logged in accounts, with the name of the database corresponding to your Google User ID.

#Apple safari alert iphone plus

While actual access to the content of each database is restricted, a malicious actor could still harvest information about what other websites a person visited in different tabs or windows, plus information about certain logged-in accounts (including Google accounts). To put it simply, the names of all IndexedDB databases are available to any site that you are visiting in the same session.”

“The researchers found that the current version of WebKit, the browser engine that powers Safari…can be tricked into skipping the same-origin check. “IndexedDB is a browser API for client-side storage designed to hold significant amounts of data,” explained researchers at Malwarebytes, in a Wednesday overview of the original analysis. If exploited, cyberattackers could use a malicious website to track a victim’s internet activity and could possibly uncover the user’s identity. In this case, the specific issue exists in Safari 15’s implementation of the IndexedDB API, researchers said in a recent posting.

#Apple safari alert iphone free

Without this security policy in place, a snooper who manages to inject a malicious script into one website would be able to have free access to any data contained in other tabs the victim may have open in the browser, including access to online banking sessions, emails, healthcare portal data and other sensitive information.

Typically, a web browser permits scripts on one web page to access data on a second web page only if both pages have the same origin/back-end server. Apple has just marked the issue as “resolved,” but it will take some time for the fixes to roll out, they said, so users should implement mitigations.Īccording to researchers at FingerprintJS, the bug is a same-origin policy violation. A security vulnerability in Apple’s browsers for macOS, iOS and iPadOS can lead to information disclosure, researchers have warned.