Overview
- The patch addresses CVE-2026-20643, a WebKit Navigation API cross-origin flaw that could bypass the Same Origin Policy, credited to researcher Thomas Espach and fixed via improved input validation.
- Apple shipped the fixes as iOS 26.3.1 (a), iPadOS 26.3.1 (a), macOS 26.3.1 (a), and macOS 26.3.2 (a), with the 26.3.2 variant targeting MacBook Neo models.
- Apple has not indicated in-the-wild exploitation, but WebKit’s role across Safari, third‑party browsers on iOS, and in‑app web views makes prompt patching important for privacy and security.
- Users can manage Background Security Improvements in Settings > Privacy & Security to install or enable Automatic Install, and the update typically completes after a brief restart.
- If a BSI is removed, the device reverts to the baseline OS without the background patches, and security vendors advise enabling automatic BSIs to minimize exposure windows.