{"id":"CVE-2016-1864","url":"https://www.cyber-defence.io/tools/cve/CVE-2016-1864","generatedAt":"2026-10-27T21:03:25.992Z","title":"The XSS auditor in WebKit, as used in Apple iOS before 9.3 and Safari before 9.1, does not properly handle redirects in block mode, which allows remote attackers to obtain sensitive information via a crafted URL.","description":"The XSS auditor in WebKit, as used in Apple iOS before 9.3 and Safari before 9.1, does not properly handle redirects in block mode, which allows remote attackers to obtain sensitive information via a crafted URL.","published":"2016-06-19T20:59:11.000Z","lastModified":"2026-06-17T00:42:47.000Z","status":"Modified","sourceIdentifier":"product-security@apple.com","cvss":{"version":"3.0","score":4.3,"severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},"cwe":["CWE-200"],"affected":["apple/safari","apple/iphone os"],"epss":{"score":0.01864,"percentile":0.79125,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (1.86%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html","tags":["Vendor Advisory"],"source":"product-security@apple.com"},{"url":"http://lists.apple.com/archives/security-announce/2016/Mar/msg00005.html","tags":["Vendor Advisory"],"source":"product-security@apple.com"},{"url":"http://www.securityfocus.com/bid/91358","source":"product-security@apple.com"},{"url":"http://www.securitytracker.com/id/1036344","source":"product-security@apple.com"},{"url":"https://support.apple.com/HT206166","tags":["Vendor Advisory"],"source":"product-security@apple.com"},{"url":"https://support.apple.com/HT206171","tags":["Vendor Advisory"],"source":"product-security@apple.com"},{"url":"http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.apple.com/archives/security-announce/2016/Mar/msg00005.html","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/91358","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id/1036344","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/HT206166","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/HT206171","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2016-1864","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}