CVE-2016-1785

The Page Loading implementation in WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles character encoding during access to cached data, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.

• CWE-200

• http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.htmlVendor Advisory
• http://lists.apple.com/archives/security-announce/2016/Mar/msg00005.htmlVendor Advisory
• http://www.securityfocus.com/archive/1/537948/100/0/threaded
• http://www.securitytracker.com/id/1035353
• https://support.apple.com/HT206166Vendor Advisory
• https://support.apple.com/HT206171Vendor Advisory
• http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.htmlVendor Advisory
• http://lists.apple.com/archives/security-announce/2016/Mar/msg00005.htmlVendor Advisory
• http://www.securityfocus.com/archive/1/537948/100/0/threaded
• http://www.securitytracker.com/id/1035353
• https://support.apple.com/HT206166Vendor Advisory
• https://support.apple.com/HT206171Vendor Advisory

Published

Mar 24, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-1779WebKit in Apple iOS before 9.3 and Safari before 9.1 allows …
• CVE-2016-1780WebKit in Apple iOS before 9.3 does not prevent hidden web v…
• CVE-2016-1781WebKit in Apple iOS before 9.3 and Safari before 9.1 mishand…
• CVE-2016-1782WebKit in Apple iOS before 9.3 and Safari before 9.1 does no…
• CVE-2016-1783WebKit in Apple iOS before 9.3, Safari before 9.1, and tvOS …
• CVE-2016-1784The History implementation in WebKit in Apple iOS before 9.3…
• CVE-2016-1786The Page Loading implementation in WebKit in Apple iOS befor…
• CVE-2016-1787Wiki Server in Apple OS X Server before 5.1 allows remote at…
• CVE-2016-1788Messages in Apple iOS before 9.3, OS X before 10.11.4, and w…
• CVE-2016-1789Apple iBooks Author before 2.4.1 allows remote attackers to …
• CVE-2016-1790Buffer overflow in the Accessibility component in Apple iOS …
• CVE-2016-1791The AMD subsystem in Apple OS X before 10.11.5 allows attack…