Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Apple Prepares Fix for Safari Bug Allowing Websites to Decipher Your Recent Browsing Activity

MacRumors

MacRumors

macrumors bot
Original poster
Apr 12, 2001
67,805
38,418


Over the weekend, we reported on a bug in WebKit's implementation of a JavaScript API called IndexedDB that can reveal your recent browsing history and even your identity, according to browser fingerprinting service FingerprintJS.

safari-icon-blue-banner.jpeg

Apple has since prepared a fix for the bug, according to a WebKit commit on GitHub, but the fix will not be available to users until Apple releases macOS Monterey, iOS 15, and iPadOS 15 updates with an updated version of Safari. Apple declined to comment when asked to provide a timeframe for a fix being released to the public.

The bug allows any website that uses IndexedDB for client-side data storage to access the names of IndexedDB databases generated by other websites during a user's browsing session. The bug could allow one website to track other websites the user visits in different tabs or windows, as the database names are often specific to each website, and sometimes the database names contain user-specific identifiers that could reveal a user's identity.

FingerprintJS has a live demo of the bug, which affects newer versions of browsers using Apple's open source browser engine WebKit, including Safari 15 for macOS and Safari on all versions of iOS 15 and iPadOS 15. The bug also affects third-party browsers like Chrome and Edge on iOS 15 and iPadOS 15, as Apple requires all iPhone and iPad browsers to use WebKit.

The bug does not affect Safari 14 for macOS or any browser on iOS 14 and iPadOS 14, according to FingerprintJS, which has a blog post with more details.

Article Link: Apple Prepares Fix for Safari Bug Allowing Websites to Decipher Your Recent Browsing Activity
 
Article Link
https://www.macrumors.com/2022/01/18/apple-prepares-fix-for-safari-indexeddb-bug/
Last edited:
  • Like
Reactions: RandomDSdevel
MacRumors said:
The bug does not affect Safari 14 for macOS or any browser on iOS 14 and iPadOS 14
Click to expand...
Yet again, upgrading right when a new macOS or iOS is released causes major problems for users! If I could get Tim Cook to do one thing, it would be to stop the forced annual releases of OS's. It's not like Apple would take a sales revenue hit from stretching out releases to 18 or 24 months...
 
  • Like
  • Disagree
  • Love
Reactions: NEV3S, sideshowuniqueuser, jasoncarle and 18 others
but the fix will not be available to users until Apple releases macOS Monterey, iOS 15, and iPadOS 15 updates with an updated version of Safari.
Click to expand...

Why can't we have Safari separated from the OS? I didn't have to update macOS for iTunes updates. Never had to update iOS for updates to Pages, Numbers, Keynote, etc.

They do update Safari separate from macOS on older versions of macOS.. Why can't the same be done with the latest/current release of macOS (and iOS/iPadOS)?
 
  • Like
Reactions: Rexogamer, revanmj, steve333 and 14 others
sw1tcher said:
What do you mean Apple is preparing for a fix?

Apple just issued a fix for macOS and users can get it right here :p
Click to expand...
I’m a big fan of Mozilla, Firefox browser. Been using it for years. Possibly a decade. It's too bad I'm addicted to Safari. But Firefox is my 2nd go-to.

Good suggestion though. 👌☝️
 
  • Like
  • Haha
Reactions: Anthony Sullivan, mainemini, orbital~debris and 11 others
KaliYoni said:
Yet again, upgrading right when a new macOS or iOS is released causes major problems for users! If I could get Tim Cook to do one thing, it would be to stop the forced annual releases of OS's. It's not like Apple would take a sales revenue hit from stretching out releases to 18 or 24 months...
Click to expand...
While I agree that a longer upgrade cycle on the OS would allow for more polish, I doubt a lot of bugs (especially like this one) would be discovered even with more time. Until the upgrade is released not enough people run the betas to find a lot of these issues (although to be VERY fair, there are plenty of bugs that ARE well-known and ship anyway - and those might be fixed).
 
  • Like
Reactions: mekump, jam9, orbital~debris and 2 others
ouimetnick said:
Why can't we have Safari separated from the OS? I didn't have to update macOS for iTunes updates. Never had to update iOS for updates to Pages, Numbers, Keynote, etc.

They do update Safari separate from macOS on older versions of macOS.. Why can't the same be done with the latest/current release of macOS (and iOS/iPadOS)?
Click to expand...
Because Safari is the new IE. I only somewhat kid... Remember when we all blasted Microsoft for this exact behavior in Win98? :(
 
  • Like
Reactions: revanmj, steve333, bernuli and 10 others
KaliYoni said:
Yet again, upgrading right when a new macOS or iOS is released causes major problems for users! If I could get Tim Cook to do one thing, it would be to stop the forced annual releases of OS's. It's not like Apple would take a sales revenue hit from stretching out releases to 18 or 24 months...
Click to expand...
Whatever date is put on a release, there is always issues. Can't say I was a fan of the longer releases as it just delayed features being added, although I suspect the current schedule has more to do with iOS rather than MacOS.
Unless you're buying new kit or want to keep up with iOS, no-one is forcing you to upgrade every 12 months.
 
KaliYoni said:
Yet again, upgrading right when a new macOS or iOS is released causes major problems for users! If I could get Tim Cook to do one thing, it would be to stop the forced annual releases of OS's. It's not like Apple would take a sales revenue hit from stretching out releases to 18 or 24 months...
Click to expand...
But, but, but, YouTubers would run out of topics to talk to, to generate clicks, views and revenue ohhhhhh the world is shattering because Apple doesn’t release software on a daily basis and nothing interesting to talk about nooooooo…….

You get the idea.
 
  • Haha
  • Like
Reactions: winxmac, KaliYoni and idktbh
ian87w said:
Time for Apple to start compartmentalizing iOS. Aren't anyone at Apple see how wrong it is to wait for an iOS update just to patch Safari/webkit? Apple, go work it out like Android, where the browser and system webview can be updated independently of the OS itself.
Click to expand...
I suspect they believe releasing separate browser update cost them more because of how they wrote safari in the first place, just like IE back in Windows 98.
 
  • Like
Reactions: winxmac, mainemini and zapmymac
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back