CVE-2026-20643 - Vulnerability Analysis

Overview

Apple iOS 26.3.1, iPadOS 26.3.1, macOS 26.3.1 and 26.3.2 contain a cross-origin issue caused by insufficient input validation in the Navigation API, letting attackers bypass Same Origin Policy via crafted web content, exploit requires victim to process malicious content.

Severity & Score

Impact

Attackers can bypass Same Origin Policy, potentially leading to unauthorized data access across origins.

Mitigation

Update to iOS 26.3.1, iPadOS 26.3.1, macOS 26.3.1 or later.

References

• https://support.apple.com/en-us/126604
• http://seclists.org/fulldisclosure/2026/Mar/10

Social Media Activity(1 post)

OverSecurity

@oversecurity

Mar 19, 2026

Apple Patches WebKit Vulnerability CVE-2026-20643 Across iOS, macOS Apple has released a new security update to address a critical WebKit vulnerability tracked as CVE-2026-20643. The vulnerability was identified 🔗️ [Thecyberexpress] https://link.is.it/lPLEWn

View original post

GitHub Repositories(2 repos)

• https://github.com/Fliv/CVE-2026-20643
• https://github.com/zeroxjf/WebKit-NavigationAPI-SOP-Bypass

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner