CVE-2009-1714: Cross-site scripting (XSS) vulnerability in Web Inspector in WebKit in Apple Safari before 4.0 allows user-...

Security readout for executives and security teams

This is an old Safari/WebKit Web Inspector flaw. If a user interacted with malicious content through affected Safari versions before 4.0, an attacker could inject script or HTML and potentially read local files. The available bundle does not show active exploitation or current KEV listing. Exposure is most likely limited to legacy systems running Apple Safari before 4.0 or unpatched WebKit builds tied to that era. Modern managed fleets are unlikely to be exposed unless old browsers, embedded WebKit components, or unsupported operating images remain in use. Treat this as a legacy exposure cleanup item unless old Safari/WebKit remains in production. It is not KEV-listed in the bundle, but the local file read impact means unsupported browser remnants should be removed or isolated promptly. Mitigation focus: Upgrade Safari/WebKit using vendor security guidance.; Remove or isolate Safari versions before 4.0.; Check Apple security advisory details for the applicable fixed release..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.