CVE-2016-1864: The XSS auditor in WebKit, as used in Apple iOS before 9.3 and Safari before 9.1, does not properly handle...

Security readout for executives and security teams

CVE-2016-1864 is an information disclosure flaw in WebKit's XSS auditor. Apple fixed it in iOS 9.3 and Safari 9.1. The practical business concern is legacy Apple devices or browsers that were never updated, where a maliciously crafted URL could expose sensitive information. Exposure is most likely limited to unmanaged, legacy, or unsupported Apple endpoints still running iOS before 9.3 or Safari before 9.1. The supplied affected-product metadata is incomplete, so do not infer broader WebKit product exposure from this bundle alone. Treat this as a legacy exposure cleanup item unless old Apple devices are still in business use. It is not supported by KEV or active-exploitation evidence in the supplied sources, but unpatched browsers handling sensitive sessions remain a meaningful risk. Mitigation focus: Update affected Apple iOS devices to iOS 9.3 or later.; Update Safari installations to Safari 9.1 or later.; Retire devices that cannot receive supported Apple security updates..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.