CVE-2010-3259: Apple iPhone OS

Medium severity, CVSS 4.3. EPSS: 1.6% chance of exploitation in the next 30 days.

WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3, Google Chrome before 6.0.472.53, and webkitgtk before 1.2.6, does not properly restrict read access to images derived from CANVAS elements, which allows remote attackers to bypass the Same Origin Policy and obtain potentially sensitive image data via a crafted web site.

Affected products

• Apple iPhone OS: before 4.2 (fixed in 4.2)
• Apple Safari: before 4.1.3 (fixed in 4.1.3); from 5.0, before 5.0.3 (fixed in 5.0.3)
• Canonical Ubuntu Linux: version 9.10 only; version 10.04 only; version 10.10 only
• Google Chrome: before 6.0.472.53 (fixed in 6.0.472.53)
• WebKitGTK WebKitGTK: before 1.2.6 (fixed in 1.2.6)

Published 2010-09-07. Last modified 2026-06-16.