Vulnerability in Safari exposes browser history and Google usernames

FingerprintJS Experts establishedthat the problem is in Safari 15 on all devices. The vulnerability also provides access to data in other browsers on iOS 15 and iPadOS 15.

Due to the use of the IndexedDB standard, the software stores data on users' devices. Normally, only the site for which it was created can access its database.

But in Safari, with each such access attempt, new empty bases are created for all windows and tabs - with the same names as the original one. As a result, third-party resources see what other pages are being visited.

In addition, YouTube, calendar and other Google services store user logins in the names of their local databases. Using them, cybercriminals can also obtain other data, such as the last name, first name, and account photo.

You can see how it works at special sitegenerated by FingerprintJS - it shows recent activity in Safari. Experts reported the problem to Apple on November 21, 2021, but the vulnerability has not yet been closed.