Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

Safari private browsing may store login credentials, enabling tracking

CVE-2015-3754 · published 11 years ago
Summary

Apple Safari versions before 6.2.8, 7.1.8, and 8.0.8 do not fully clear saved login information in private‑browsing mode. This can allow a malicious website to see a user’s authentication details and track their activity. Updating Safari to a newer version or avoiding private browsing for sensitive logins resolves the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
– apple safari >= 6.0, < 6.2.8
>= 7.0, < 7.1.8
>= 8.0, < 8.0.8
cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
Ubuntu:16.04:LTS canonical qtwebkit-opensource-src All versions
Ubuntu:16.04:LTS canonical qtwebkit-source All versions
Ubuntu:16.04:LTS canonical webkitgtk All versions
Original advisory text
The private-browsing implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8 does not prevent caching of HTTP authentication credentials, which makes it easier...
The private-browsing implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8 does not prevent caching of HTTP authentication credentials, which makes it easier for remote attackers to track users via a crafted web site.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.3 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published16 Aug 2015
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2015-3754 · NVD
UBUNTU-CVE-2015-3754 · OSV
Track software like this
Free during beta