Apple has released its first security fix delivered outside the traditional OS update cycle, addressing CVE-2026-20643, a WebKit vulnerability that could allow malicious web content to bypass the browser’s Same Origin Policy.
Instead of requiring a full OS upgrade and device restart, Apple delivered the fix through its new Background Security Improvements feature.
🔐 What this means:
• Rapid security fixes for WebKit, Safari, and system libraries
• No full OS update required
• Smaller patches applied silently in the background
The vulnerability was discovered by Thomas Espach and patched in:
- iOS 26.3.1
- iPadOS 26.3.1
- macOS 26.3.1 / 26.3.2
⚠️ Apple also warns that removing background security updates disables all incremental patches, reverting devices to the base OS security level.
This marks an important shift toward faster security response on Apple devices.
