# WebKit security flaw exposes iPhone and Mac users to data leaks Critical vulnerability found in Apple's browser engine affecting millions - **Source:** [Cult of Mac](https://brifing.si/source/7e2968d9-bc24-4286-8f9e-146807f06336) - **Published:** 2026-08-05 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/a0e7b698-cfb5-4905-a8c0-35061bf3124e ## Critical vulnerability in WebKit A severe security flaw has been discovered in WebKit, the browser engine powering all Apple devices. This vulnerability could allow malicious websites to access user data without permission. Experts confirm the issue primarily affects Safari users. While Apple hasn't issued an official statement yet, an emergency patch is expected soon. The timing is particularly concerning as more users conduct sensitive transactions online. ## Affected devices and systems The vulnerability impacts all iPhones running iOS 16+, iPads with iPadOS, and Macs using macOS Ventura or later. Both Intel-based Macs and those with M1/M2 chips are vulnerable. As a temporary workaround, security professionals suggest using alternative browsers, though most still rely on WebKit at their core. Users should avoid accessing sensitive accounts until a fix is released. The widespread nature of this flaw makes it one of Apple's most significant security challenges this year. ## Potential data exposure risks Security analysts warn the flaw could leak cookies, session data, and potentially passwords in certain scenarios. Logged-in accounts appear particularly vulnerable, with banking and social media platforms at highest risk. Researchers demonstrated how the exploit could track users across multiple sites. Apple device owners should monitor account activities closely. Two-factor authentication is strongly recommended for all important accounts during this vulnerable period. ## Historical context of WebKit flaws This incident recalls the 2022 IndexedDB leak that similarly exposed Safari users' data. Apple patched that vulnerability within 48 hours. In 2021, another WebKit flaw enabled remote device takeover. WebKit accounts for 28% of all Apple security patches in 2023. The engine's mandatory use in iOS browsers and its complex architecture make it a frequent target. Experts argue Apple needs to allocate more resources to WebKit security. ## Immediate user precautions Security experts recommend several protective measures: First, check for system updates daily. Avoid suspicious websites and clear browser caches regularly. Consider using a VPN, especially on public networks. Temporarily limit sensitive transactions if possible. Enable two-factor authentication everywhere. Monitor financial statements for unusual activity. These steps can reduce risk until Apple releases its official patch. ## Apple's response timeline Historically, Apple addresses critical security issues within 1-2 weeks. Given this flaw's severity, a faster response is expected. Reports suggest Apple's security team is working around the clock. The patch will likely undergo beta testing before public release. Users should watch for iOS 17.5 or macOS 14.5 updates. Enterprise users may receive prioritized patches through MDM solutions. The tech community awaits Apple's official security bulletin. ## Security researchers' concerns Independent researchers classified this as a zero-day vulnerability actively being exploited. The discovering team broke standard protocol by publicizing the flaw before Apple's 90-day disclosure period ended. This unprecedented move underscores the threat's severity. High-profile targets like journalists and executives face particular risk. Some researchers suggest this might prompt Apple to reconsider its WebKit monopoly on iOS browsers. ## WebKit's security track record WebKit has had over 15 critical vulnerabilities in three years, raising questions about Apple's security priorities. Despite Apple's reputation for privacy, WebKit flaws consistently make devices vulnerable. The engine's mandatory status prevents true browser competition on iOS. Some experts advocate allowing alternative engines like Blink or Gecko. Others suggest Apple needs to fundamentally redesign WebKit's security architecture to prevent similar issues. ## Long-term implications for Apple This incident damages Apple's security-first reputation at a time when privacy is a key marketing differentiator. The company may need to implement more frequent security audits and faster patch deployment systems. Transparency about vulnerability management will be crucial for maintaining user trust. Some analysts predict this could accelerate Apple's plans to isolate browser components better. Ultimately, it may lead to improved security standards across the industry. ## Sources covering this story - https://www.cultofmac.com/news/webkit-privacy-leak-ios-macos — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._