#Apple safari web back browser risk windows

#Apple safari web back browser risk windows

The analysts at FingerprintJS have created a demo website ( ) that shows the leak in action and works for more than 20 websites open in other tabs and windows in the same profile. Since this user ID is an identifier, it can be potentially used to retrieve the person's details such as the profile picture, for example. A malicious website can simply trigger opening of an iframe or popup and scrap this information. Websites such as Google and its services create databases that include the Google user ID for each logged-in account. Thus, even information in private windows is not secure. This means a cleverly coded website from a different 'origin' can essentially scrap what the user is visiting in any open tab or windows unless a different profile is used. Same-origin is a critical security mechanism that prevents documents or scripts from one origin interacting with data or resources from other origins unless permitted via cross-origin resource sharing (CORS).Īccording to FingerprintJS, who first reported the issue to Apple back on November 28 itself, Safari 15 on macOS and all browsers on iOS 15 and iPadOS 15 create an empty database with the same name for all active windows and tabs each time a website interacts with IndexedDB. Two URLs are said to have the same origin if they use the same protocol, port (if specified), and host. In Safari 15, the IndexedDB API is seen violating the ' same-origin policy'. IndexedDB is accessed via a low-level API, which is usually abstracted for a more developer-friendly API. Each browser determines its own limits on how much space to allocate to IndexedDB and automatically deletes data as those limits near, based on defined criteria. Therefore, information such Google user ID strings can be seen by unauthorized third-parties potentially compromising one's identity.Īll browsers use an IndexedDB or an indexed database to store significant amounts of data on the client's storage for quick retrieval. A bug exists in Safari 15's implementation of IndexedDB, which enables any website to read database entries of not only its own but of other websites as well.

Safari users on macOS and iOS may be vulnerable to a serious privacy violation.