It relied on the fact that although your website couldn’t access any of the data stored locally by my website (a consequence of the Same Origin Policy enforced by browsers to keep web data private to the page that created it in the first place), it could list the names of any databases I’d created for my data. The CVE-2022-22594 bug was annoyingly simple. In fact, that vulnerability, now known as CVE-2022-22594, showed up in Safari because of a bug in WebKit, the “browser rendering engine”, as these things are generally known, on which the Safari app is based.Īnd although Safari is the only mainstream WebKit-based browser on Apple’s macOS (Edge and Chromium use Google’s Blink engine Firefox uses Mozilla’s Gecko renderer), that’s not the case on Apple’s mobile devices.Īny browser or browser-like app in the App Store, which is essentially the only source of software for iPhones, iPads, Apple Watches and so on, must be programmed to use WebKit, even if it uses a third-party rendering engine on other platforms.Īs a result, macOS users could simply switch browsers to sidestep the bug, while iDevice users could not. Just under two weeks ago, we wrote about an Apple Safari bug that could allow rogue website operators to track you even if they gave every impression of not doing so, and even if you had strict privacy protection turned on.

Cuddle phish for mac gif