CVE-2009-2816: Apple iPhone OS

Medium severity, CVSS 6.8. EPSS: 1.6% chance of exploitation in the next 30 days.

The implementation of Cross-Origin Resource Sharing (CORS) in WebKit, as used in Apple Safari before 4.0.4 and Google Chrome before 3.0.195.33, includes certain custom HTTP headers in the OPTIONS request during cross-origin operations with preflight, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a crafted web page.

Affected products

• Apple iPhone OS: before 4.0 (fixed in 4.0)
• Apple Safari: before 4.0.4 (fixed in 4.0.4)
• Fedoraproject Fedora: version 11 only; version 12 only
• Google Chrome: before 3.0.195.33 (fixed in 3.0.195.33)
• Opensuse Opensuse: version 11.2 only; version 11.3 only

Published 2009-11-13. Last modified 2026-06-16.