CVE-2016-1785

Severity: medium (CVSS 6.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-03-24 · updated 2026-06-17
Weakness: CWE-200

Description

The Page Loading implementation in WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles character encoding during access to cached data, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.

Affected products

Apple Iphone Os: through 9.2.1
Apple Safari: through 9.0.3

References

http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html
http://lists.apple.com/archives/security-announce/2016/Mar/msg00005.html
http://www.securityfocus.com/archive/1/537948/100/0/threaded
http://www.securitytracker.com/id/1035353
https://support.apple.com/HT206166
https://support.apple.com/HT206171
http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html
http://lists.apple.com/archives/security-announce/2016/Mar/msg00005.html
http://www.securityfocus.com/archive/1/537948/100/0/threaded
http://www.securitytracker.com/id/1035353
https://support.apple.com/HT206166
https://support.apple.com/HT206171

Get alerted when CVE-2016-1785 or the next vulnerability affects your stack