Description
An authorization issue was addressed with improved state management. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4, watchOS 26.4. A maliciously crafted webpage may be able to fingerprint the user.
Published: 2026-03-25
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: User Fingerprinting
Action: Apply Patch
AI Analysis

Impact

An authorization flaw in Apple’s state management for web browsers and operating systems permits maliciously crafted web pages to fingerprint users. The flaw does not allow remote code execution or data exfiltration but can reveal identifying information about the user’s device, browser state, or usage patterns, thereby violating privacy. The weakness is classified as CWE‑497.

Affected Systems

Apple Safari, iOS, iPadOS, macOS, visionOS, and watchOS versions prior to 26.4 are affected. Apple recommends upgrading to Safari 26.4, iOS 26.4 / iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4, or watchOS 26.4 to remediate the issue.

Risk and Exploitability

The vulnerability scores a CVSS 4.3, indicating medium exposure with limited impact on confidentiality or integrity but notable privacy risks. EPSS is reported to be below 1 %, suggesting a low likelihood of exploitation in the wild. Apple does not list this in the KEV catalog. Exploitation likely requires a user to visit a malicious web page, using standard HTTP(S) as the attack vector. Given the privacy implications, the risk to end users is moderate but decreases substantially once the vendor‑supplied patch is applied.

Generated by OpenCVE AI on March 25, 2026 at 19:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update to Safari 26.4 or later on macOS.
  • Update iOS 26.4 / iPadOS 26.4 on compatible devices.
  • Update macOS Tahoe 26.4 on supported systems.
  • Update visionOS 26.4 if applicable.
  • Update watchOS 26.4 if applicable.
  • If an update is not immediately available, block or filter URLs from sites known to serve malicious pages using network or browser security tools.

Generated by OpenCVE AI on March 25, 2026 at 19:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 31 Mar 2026 03:00:00 +0000

Type Values Removed Values Added
Title Apple Device Webpage Fingerprinting Vulnerability Due to Improper State Management webkitgtk: A maliciously crafted webpage may be able to fingerprint the user
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 25 Mar 2026 22:00:00 +0000

Type Values Removed Values Added
Title Apple Device Webpage Fingerprinting Vulnerability Due to Improper State Management

Wed, 25 Mar 2026 18:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple ipados
Apple iphone Os
CPEs cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
Vendors & Products Apple ipados
Apple iphone Os

Wed, 25 Mar 2026 15:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-497
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 25 Mar 2026 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios And Ipados
Apple macos
Apple safari
Apple visionos
Apple watchos
Vendors & Products Apple
Apple ios And Ipados
Apple macos
Apple safari
Apple visionos
Apple watchos

Wed, 25 Mar 2026 01:00:00 +0000

Type Values Removed Values Added
Description An authorization issue was addressed with improved state management. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4, watchOS 26.4. A maliciously crafted webpage may be able to fingerprint the user.
References

Subscriptions

Apple Ios And Ipados Ipados Iphone Os Macos Safari Visionos Watchos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-04-02T18:27:20.744Z

Reserved: 2025-11-11T14:43:07.876Z

Link: CVE-2026-20691

cve-icon Vulnrichment

Updated: 2026-03-25T15:08:46.552Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-25T01:17:05.910

Modified: 2026-03-25T20:52:59.450

Link: CVE-2026-20691

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-03-28T20:00:00Z

Links: CVE-2026-20691 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-03-25T21:16:03Z

Weaknesses