Apple has released its first round of Background Security Enhancements to address a vulnerability in WebKit affecting iOS, iPadOS, and macOS. The vulnerability, identified as CVE-2026-20643, relates to a cross-origin issue in the WebKit Navigation API. This could allow an attacker to bypass the same-origin policy by processing malicious web content, jeopardizing user security.
Apple’s new strategy
The implementation of these security improvements is carried out through smaller and continuous updates, allowing for a more agile response to potential threats. This strategy is similar to the Security Rapid Response system introduced in iOS 16, designed to facilitate the installation of minor security patches without having to wait for larger software updates. The new versions affect iOS 26.3.1, iPadOS 26.3.1, and the versions of macOS 26.3.1 and 26.3.2, with improvements in input validation to mitigate risk.
Any user can manage these security improvements through the Privacy and Security menu in the Settings app. To ensure the automatic installation of these updates, it is recommended to keep the Automatic Installation option enabled. If this option is disabled, users will have to wait until the next major software update to receive the patches.

Additionally, this update comes shortly after Apple addressed an actively exploited zero-day, which affected multiple operating systems, and also expands patches for several vulnerabilities that were used in the Coruna exploit kit. These moves reinforce Apple’s commitment to security and its ability to respond quickly to emerging threats.