CVE-2016-4758

Severity: medium (CVSS 6.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-09-25 · updated 2026-06-17
Weakness: CWE-200

Description

WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly restrict access to the location variable, which allows remote attackers to obtain sensitive information via a crafted web site.

Affected products

Apple Iphone Os: through 9.3.5
Apple iTunes for Windows: through 12.4.3
Apple Safari: through 9.1.3

References

http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.html
http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html
http://lists.apple.com/archives/security-announce/2016/Sep/msg00012.html
http://mksben.l0.cm/2016/09/safari-uxss-showModalDialog.html
http://www.securityfocus.com/bid/93066
http://www.securitytracker.com/id/1036854
https://support.apple.com/HT207143
https://support.apple.com/HT207157
https://support.apple.com/HT207158
http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.html
http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html
http://lists.apple.com/archives/security-announce/2016/Sep/msg00012.html

Get alerted when CVE-2016-4758 or the next vulnerability affects your stack