CVE-2010-1760: Apple Webkit

High severity, CVSS 10.0. EPSS: 2.6% chance of exploitation in the next 30 days.

loader/DocumentThreadableLoader.cpp in the XMLHttpRequest implementation in WebCore in WebKit before r58409 does not properly handle credentials during a cross-origin synchronous request, which has unspecified impact and remote attack vectors, aka rdar problem 7905150.

Affected products

• Apple Webkit: up to and including r58408; version r50173 only; version r56187 only; version r56188 only; version r56379 only

Published 2010-08-19. Last modified 2026-06-16.