Description
This issue was addressed through improved state management. This issue is fixed in Safari 17.5, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. A maliciously crafted webpage may be able to fingerprint the user.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apple | Safari | < 17.5 | 17.5 |
| Apple | iOS and iPadOS | < 17.5 | 17.5 |
| Apple | macOS | < 14.5 | 14.5 |
| Apple | tvOS | < 17.5 | 17.5 |
| Apple | visionOS | < 1.2 | 1.2 |
| Apple | watchOS | < 10.5 | 10.5 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | qtwebkit-opensource-src | No fix yet | — |
| Ubuntu 22.04 LTS | wpewebkit +1 | No fix yet | — |
| Ubuntu 20.04 LTS | wpewebkit +2 | No fix yet | — |
| Ubuntu 18.04 LTS | webkitgtk +3 | No fix yet | — |
| Ubuntu 16.04 LTS | webkitgtk +3 | No fix yet | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | webkitgtk4 +3 | 2.46.6-1.amzn2.0.2 | ALAS2-2025-2869 |
Advisories 3
- WID-SEC-2024-1109 Apple macOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 4, 2026
- WID-SEC-2024-1097 Apple iOS und iPadOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 4, 2026
- ALAS2-2025-2869 Important: webkitgtk4 security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Mar 23, 2026