CVE-2016-1864

Severity: medium (CVSS 4.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-06-19 · updated 2026-06-17
Weakness: CWE-200

Description

The XSS auditor in WebKit, as used in Apple iOS before 9.3 and Safari before 9.1, does not properly handle redirects in block mode, which allows remote attackers to obtain sensitive information via a crafted URL.

Affected products

Apple Iphone Os: through 9.2.1
Apple Safari: through 9.0.3

References

http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html
http://lists.apple.com/archives/security-announce/2016/Mar/msg00005.html
http://www.securityfocus.com/bid/91358
http://www.securitytracker.com/id/1036344
https://support.apple.com/HT206166
https://support.apple.com/HT206171
http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html
http://lists.apple.com/archives/security-announce/2016/Mar/msg00005.html
http://www.securityfocus.com/bid/91358
http://www.securitytracker.com/id/1036344
https://support.apple.com/HT206166
https://support.apple.com/HT206171

Get alerted when CVE-2016-1864 or the next vulnerability affects your stack