The issue was addressed with improved checks. This issue is fixed in Safari 26.1, visionOS 26.1, watchOS 26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. A malicious website may exfiltrate data cross-origin.
| Software | From | Fixed in |
|---|---|---|
| apple / safari | - | 26.1 |
| apple / ipados | - | 26.1 |
| apple / iphone_os | - | 26.1 |
| apple / tvos | - | 26.1 |
| apple / visionos | - | 26.1 |
| apple / watchos | - | 26.1 |