AudioWorklet CSP Bypass in Safari, iOS, iPadOS, macOS

A Content Security Policy bypass was addressed with improved enforcement in AudioWorklet contexts. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5. Processing maliciously crafted web content may bypass Content Security Policy.

This CVE ID has been rejected.

This CVE ID has been rejected.

This CVE ID has been rejected.

This CVE ID has been rejected.

This CVE ID has been rejected.

This CVE ID has been rejected.

This CVE ID has been rejected.

This CVE ID has been rejected.

This CVE ID has been rejected.

This CVE ID has been rejected.

This CVE ID has been rejected.

This CVE ID has been rejected.

This CVE ID has been rejected.

This CVE ID has been rejected.

This CVE ID has been rejected.

This CVE ID has been rejected.

Information leak in QUIC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Race Condition in Chrome Payments Module Enables Cross‑Origin Data Leakage

Race condition in Payments in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

Information leak in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low)