This issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, visionOS 2.4, macOS Sequoia 15.4. A website may be able to bypass Same Origin Policy.
| Software | From | Fixed in |
|---|---|---|
| apple / ipados | - | 18.4 |
| apple / iphone_os | - | 18.4 |
| apple / visionos | - | 2.4 |
| apple / safari | - | 18.4 |
| apple / macos | - | 15.4 |