Overview
- Users report Apple Podcasts opening on iPhones, iPads, and Macs after visiting certain webpages and displaying unfamiliar episodes.
- Security researcher Patrick Wardle told 404 Media that a webpage visit can start the app and show an attacker-selected episode without user confirmation.
- At least one episode contained a link leading to a cross‑site‑scripting–manipulated page, which researchers view as evidence of active testing.
- No widespread exploitation has been confirmed, and Apple has not responded to questions about the behavior.
- Investigators advise closing the app if it launches unexpectedly and avoiding playback or tapping any links in unsolicited content.