CVE-2016-1864

The XSS auditor in WebKit, as used in Apple iOS before 9.3 and Safari before 9.1, does not properly handle redirects in block mode, which allows remote attackers to obtain sensitive information via a crafted URL.

• CWE-200

• http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.htmlVendor Advisory
• http://lists.apple.com/archives/security-announce/2016/Mar/msg00005.htmlVendor Advisory
• http://www.securityfocus.com/bid/91358
• http://www.securitytracker.com/id/1036344
• https://support.apple.com/HT206166Vendor Advisory
• https://support.apple.com/HT206171Vendor Advisory
• http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.htmlVendor Advisory
• http://lists.apple.com/archives/security-announce/2016/Mar/msg00005.htmlVendor Advisory
• http://www.securityfocus.com/bid/91358
• http://www.securitytracker.com/id/1036344
• https://support.apple.com/HT206166Vendor Advisory
• https://support.apple.com/HT206171Vendor Advisory

Published

Jun 19, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-1858WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1…
• CVE-2016-1859The WebKit Canvas implementation in Apple iOS before 9.3.2, …
• CVE-2016-1860Intel Graphics Driver in Apple OS X before 10.11.5 allows at…
• CVE-2016-1861The NVIDIA Graphics Drivers subsystem in Apple OS X before 1…
• CVE-2016-1862Intel Graphics Driver in Apple OS X before 10.11.5 allows at…
• CVE-2016-1863The kernel in Apple iOS before 9.3.3, OS X before 10.11.6, t…
• CVE-2016-1865The kernel in Apple iOS before 9.3.3, OS X before 10.11.6, t…
• CVE-2016-1866Salt 2015.8.x before 2015.8.4 does not properly handle clear…
• CVE-2016-1867The jpc_pi_nextcprl function in JasPer 1.900.1 allows remote…
• CVE-2016-1876The backend service process in Lenovo Solution Center (aka L…
• CVE-2016-1879The Stream Control Transmission Protocol (SCTP) module in Fr…
• CVE-2016-1880The Linux compatibility layer in the kernel in FreeBSD 9.3, …