vulnerability

Apple Safari security update for CVE-2016-1786

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:M/Au:N/C:P/I:P/A:N)

Published

Mar 23, 2016

Added

Dec 5, 2016

Modified

Mar 27, 2026

Description

The Page Loading implementation in WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles HTTP responses with a 3xx (aka redirection) status code, which allows remote attackers to spoof the displayed URL, bypass the Same Origin Policy, and obtain sensitive cached information via a crafted web site.

Solutions

apple-safari-upgrade-9_1apple-safari-windows-uninstall

References

CVE-2016-1786
https://attackerkb.com/topics/CVE-2016-1786
CWE-200
EUVD-EUVD-2016-2881
http://support.apple.com/kb/HT206171
https://euvd.enisa.europa.eu/vulnerability/EUVD-2016-2881

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report