Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.1

Safari, iPhone, iTunes and iCloud allow cross‑origin iframe access

CVE-2018-4319 · published 7 years ago
Summary

Versions of Safari, iPhone OS, iTunes for Windows, and iCloud for Windows released before iOS 12, watchOS 5, Safari 12, iTunes 12.9, and iCloud 7.7 could be tricked into loading web pages from other sites inside an iframe without proper security checks. This could let a malicious site read or manipulate data from a trusted site displayed in the iframe. Update to the latest operating system and application versions to apply the fix that correctly isolates content from different origins.

What to do
  • Update apple icloud to version 7.7 or later.
  • Update apple itunes to version 12.9 or later.
  • Update apple safari to version 12 or later.
  • Update apple iphone_os to version 12.0 or later.
Affected software
VendorProductAffected versions
apple icloud < 7.7
cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:*
apple itunes < 12.9
cpe:2.3:a:apple:itunes:*:*:*:*:*:windows:*:*
apple safari < 12
cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
apple iphone_os < 12.0
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
Original advisory text
A cross-origin issue existed with "iframe" elements. This was addressed with improved tracking of security origins. This issue affected versions prior to iOS 12, watchOS 5, Safari 12, iTunes 12.9 f...
A cross-origin issue existed with "iframe" elements. This was addressed with improved tracking of security origins. This issue affected versions prior to iOS 12, watchOS 5, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.1 High
Exploitation
1% chance of attack within 30 days
Type
CWE-346Origin Validation Error
Timeline
Published3 Apr 2019
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-4319 · NVD
Track software like this
Free during beta