Update 1/19: Apple is working on a fix, according to a Github post.
Just days after Apple patched a bug that could allow a hacker to send your iPhone into an endless loop of crashes, FingerprintJS has uncovered a Safari vulnerability that could expose your internet activity and personal data to an open website.
The bug originates in the IndexedDB API, which is used for client-side storage of significant amounts of structured data, according to Mozilla. As FingerprintJS explains, since IndexedDB is a low-level API used by all major browsers, many developers “choose to use wrappers that abstract most of the technicalities and provide an easier-to-use, more developer-friendly API.”
As such, Safari’s version of IndexedDB is violating the same-origin security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from other origins, according to FingerprintJS. Consequently, arbitrary websites could spy on the other websites a user visits in different tabs or windows.
This is a huge bug. On OSX, Safari users can (temporarily) switch to another browser to avoid their data leaking across origins. iOS users have no such choice, because Apple imposes a ban on other browser engines. https://t.co/aXdhDVIjTT
— Jake Archibald (@jaffathecake) January 16, 2022
Since some websites use unique user-specific identifiers in database names, FingerprintJS explains that authenticated users can be “uniquely and precisely identified” by sites such as YouTube, Google Calendar, and Google Keep. And since you’ll be logged in to those sites using your Google ID, the databases created for that account could be leaked, which include personal information. FingerprintJS uncovered several other sites vulnerable to the bug, including Twitter and Bloomberg.
According to a Webkit post on Github (spotted by 9to5Mac), Apple is aware of the issue and working on a fix.
You can see the bug in action using a demo created by FingerprintJS. The only known mitigation is to change browsers on macOS. iOS and iPadOS users have fewer options due to Apple’s handling of browser engines, though FingerprintJS notes that users could block all JavaScript by default and only allow it on trusted sites. That, or just wait for an update to arrive. Apple is currently preparing iOS 15.3 and macOS 12.2 for release, but it’s unclear if it includes a Safari fix.
Note: When you purchase something after clicking links in our articles, we may earn a small commission. Read our affiliate link policy for more details.
- MacOS
- iOS
Michael Simon has been covering Apple since the iPod was the iWalk. His obsession with technology goes back to his first PC—the IBM Thinkpad with the lift-up keyboard for swapping out the drive. He’s still waiting for that to come back in style tbh.
Note: This article have been indexed to our site. We do not claim legitimacy, ownership or copyright of any of the content above. To see the article at original source Click Here
Embroidered Plush Bunny With Child'S Name HandMade Custom Plush Toy Child'S First Easter Gift
$15.98 (as of March 9, 2025 20:21 GMT +00:00 - More infoProduct prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on [relevant Amazon Site(s), as applicable] at the time of purchase will apply to the purchase of this product.)
EF ECOFLOW Portable Power Station DELTA 2, 1024Wh LiFePO4 (LFP) Battery, 1800W AC/100W USB-C Output, Solar Generator(Solar Panel Optional) for Home Backup Power, Camping & RVs
$699.00 (as of March 9, 2025 19:46 GMT +00:00 - More infoProduct prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on [relevant Amazon Site(s), as applicable] at the time of purchase will apply to the purchase of this product.)
New Amazon Kindle (16 GB) - Lightest and most compact Kindle, with glare-free display, faster page turns, adjustable front light, and long battery life - Black
$109.99 (as of March 9, 2025 19:44 GMT +00:00 - More infoProduct prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on [relevant Amazon Site(s), as applicable] at the time of purchase will apply to the purchase of this product.)
NAVINE Adjustable Adirondack Chair with Retractable Ottoman, HDPE Folding Adirondack Chair with Cup Holder, All Weather Fire Pit Chair for Outdoor.
$179.99 (as of March 9, 2025 19:46 GMT +00:00 - More infoProduct prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on [relevant Amazon Site(s), as applicable] at the time of purchase will apply to the purchase of this product.)
