CVE-2026-20643

Received Received - Intake

Cross-Origin Bypass in Apple Navigation API Enables Data Exposure

Publication date: 2026-03-17

Last updated on: 2026-03-25

Assigner: Apple Inc.

Description

A cross-origin issue in the Navigation API was addressed with improved input validation. This issue is fixed in Background Security Improvements for iOS, iPadOS, and macOS, Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processing maliciously crafted web content may bypass Same Origin Policy.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-17

Last Modified

2026-03-25

Generated

2026-07-06

AI Q&A

2026-03-18

EPSS Evaluated

2026-07-05

NVD

CVE-2026-20643

EUVD

EUVD-2026-12663

Affected Vendors & Products

Vendor	Product	Version / Range
apple	ipados	to 26.3.1 (exc)
apple	iphone_os	to 26.3.1 (exc)
apple	macos	to 26.3.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-346	The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

Executive Summary

This vulnerability is a cross-origin issue in the Navigation API where maliciously crafted web content can bypass the Same Origin Policy. The Same Origin Policy is a security measure that restricts how documents or scripts loaded from one origin can interact with resources from another origin. The issue was addressed by improving input validation in the affected systems.

Impact Analysis

Because this vulnerability allows bypassing the Same Origin Policy, an attacker could potentially access or manipulate data from another origin without proper authorization. This could lead to unauthorized data exposure or manipulation when processing malicious web content.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, update your Apple devices to the fixed versions: Background Security Improvements for iOS 26.3.1, iPadOS 26.3.1, macOS 26.3.1, or macOS 26.3.2.

Hi! I’m here to help you understand CVE-2026-20643. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70