0xjohnnydev/WebKit-NavigationAPI-SOP-Bypass

PoC

WebKit NavigateEvent.canIntercept SOP bypass via cross-port interception — iOS 26.3.1 BSI (CVE-2026-20643)

view exploit source poc_in_githubauthor 0xjohnnydevpublished 2026-03-17catalog poc_in_github

exploited CVEs (1)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2026-20643US	—	0.36% (30th)	Exploit	2026-03-17
A cross-origin issue in the Navigation API was addressed with improved input validation. This issue is fixed in Background Security Improvements for iOS, iPadOS, and macOS, Safari…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.