CVE-2016-4583

low

Published 2016-07-22 · Modified 2026-05-06

CVSS v3

3.1

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

CVSS v2

2.6

VIR risk

3.1

Description

WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to bypass the Same Origin Policy and obtain image date from an unintended web site via a timing attack involving an SVG document.

Predictions

Exploit likelihood

42%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: product-security@apple.com — https://support.apple.com/HT206905

vendor Authored 2026-05-27

Vendor advisory: product-security@apple.com — https://support.apple.com/HT206902

vendor Authored 2026-05-27

Vendor advisory: product-security@apple.com — https://support.apple.com/HT206900

vendor Authored 2026-05-27

Vendor advisory: product-security@apple.com — http://lists.apple.com/archives/security-announce/2016/Jul/msg00004.html

vendor Authored 2026-05-27

Vendor advisory: product-security@apple.com — http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html

vendor Authored 2026-05-27

Vendor advisory: product-security@apple.com — http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html

OS impact

OS	Version	Status	Fixed in
macos		not-affected	`9.3.3`

Application impact

Vendor	Product	Versions	Fixed
apple	webkit	`-`
apple	safari	`{"endExcluding":"9.1.2"}`	`9.1.2`
webkitgtk	webkitgtk\+	`{"endExcluding":"2.12.2"}`	`2.12.2`

References

CWEs

CWE-362

Verify integrity in audit chain (admin only). AS-IS.