Description

A Content Security Policy bypass was addressed with improved enforcement in AudioWorklet contexts. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5. Processing maliciously crafted web content may bypass Content Security Policy.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-25T20:16:55.600Z",
  "pubdate": "2026-08-25T20:16:55.600Z",
  "executiveSummary": "A security vulnerability within the Content Security Policy (CSP) enforcement mechanism exists in the AudioWorklet execution context of Safari and related Apple operating systems. This flaw allows maliciously crafted web content to circumvent established CSP restrictions, effectively undermining the browser's origin-based security model.\nThe vulnerability is primarily a security policy enforcement failure. By exploiting the AudioWorklet's initialization or execution phase, an attacker can bypass defined restrictions on resource loading, script execution, or connection origins. This could allow for cross-site scripting (XSS), data exfiltration, or the unauthorized loading of malicious external resources.\nThe issue affects Safari 26.5, iOS 18.7.9, iPadOS 18.7.9, iOS 26.5, iPadOS 26.5, and macOS Tahoe 26.5. Successful exploitation requires the user to process malicious web content, such as navigating to a compromised website. The impact is significant as it weakens the browser's defense-in-depth architecture, potentially granting an attacker the ability to bypass sandboxing controls that rely on CSP enforcement. There are no known authentication requirements, as the attack is triggered via standard browsing activities.",
  "technicalDetails": "The vulnerability resides in the implementation of the AudioWorklet global scope, which historically failed to correctly inherit or strictly enforce the document's assigned Content Security Policy. AudioWorklets allow for high-performance, low-latency audio processing by executing JavaScript in a separate thread context, isolated from the main window's execution environment. However, the browser's enforcement engine failed to properly propagate policy directives into this isolated worker-like thread.\nRoot Cause Analysis: The underlying issue stems from a failure in the browser's policy propagation mechanism when initializing the AudioWorkletGlobalScope. The CSP engine failed to validate or apply the parent document's policy to resources instantiated or scripts executed within the AudioWorklet. This created a discrepancy between the security context of the main document and the security context of the audio processing thread.\nExploitation Flow: An attacker initiates the exploit by serving malicious web content that utilizes the Web Audio API. Specifically, the attacker defines an AudioWorkletProcessor script that initiates cross-origin requests or executes unauthorized dynamic code. Since the browser's security monitor does not apply the parent document's CSP to the AudioWorklet thread, the bypass occurs in the following sequence: 1. The victim navigates to an attacker-controlled site. 2. The site registers an AudioWorklet script via the 'addModule' method. 3. Within the AudioWorklet scope, the script performs actions prohibited by the main document's CSP, such as sending sensitive information to an unauthorized remote endpoint (e.g., using fetch() or XMLHttpRequest). 4. Because the browser failed to enforce the CSP in this context, the request is permitted, bypassing the 'connect-src' or 'script-src' directives.\nTechnical Impact: The bypass allows an attacker to ignore restrictions defined in the CSP header. This permits the loading of scripts from non-whitelisted sources, the execution of inline scripts that would otherwise be blocked, or the exfiltration of data to unauthorized origins. Because AudioWorklets run in a persistent background context, an attacker could maintain a presence that survives navigation changes within the main document, depending on the worker lifecycle management.\nVersion Scope: The vulnerability affects Safari 26.5, iOS 18.7.9, iPadOS 18.7.9, iOS 26.5, iPadOS 26.5, and macOS Tahoe 26.5. Mitigation involved an update to the AudioWorkletGlobalScope initialization logic to ensure robust enforcement and inheritance of the parent context's security policy."
}