Safari Bug Allows Websites to Track Your Recent Browsing Activity in Real Time

2 years ago 134

BOOK THIS SPACE FOR AD

ARTICLE AD

This article has been indexed from MacRumors: Mac News and Rumors – Front Page

A bug in WebKit’s implementation of a JavaScript API called IndexedDB can reveal your recent browsing history and even your identity, according to a blog post shared on Friday by browser fingerprinting service FingerprintJS.

In a nutshell, the bug allows any website that uses IndexedDB to access the names of IndexedDB databases generated by other websites during a user’s browsing session. The bug could allow one website to track other websites the user visits in different tabs or windows, as the database names are often unique and specific to each website. The correct and normal behavior should be that websites can only access their own IndexedDB databases.

In some cases, websites use unique user-specific identifiers in IndexedDB database names. For example, YouTube creates databases that include a user’s authenticated Google User ID in the name, and this identifier can be used with Google APIs to fetch personal information about the user, such as a profile picture, according to FingerprintJS. This personal information could help a malicious actor to determine a user’s identity.

The bug affects newer versions of browsers using Apple’s open source browser engine WebKit, including Safari 15 for Mac and Safari on all versions of iOS 15 and iPadOS 15. The bug also affects third-party browsers like Chrome on iOS 15 and iPadOS 15, as Apple requires all browsers to use WebKit on the iPhone and iPad. FingerprintJS has a live demo of the bug that indicates older browsers like Safari 14 for Mac are unaffected.

Content not available.
Please allow cookies by clicking Accept on the banner

FingerprintJS noted that no user action is required for a website to access IndexedDB database names generated by other websites.

“A tab or window that runs in the background and continually queries the IndexedDB API for available databases can learn what other websites a user visits in real-time,” the blog pos

[…]

Content was cut in order to protect the source.Please visit the source for the rest of the article.