CVE-2012-0585: Apple iPhone OS

Medium severity, CVSS 5.0. EPSS: 2.5% chance of exploitation in the next 30 days.

The Private Browsing feature in Safari in Apple iOS before 5.1 allows remote attackers to bypass intended privacy settings and insert history entries via JavaScript code that calls the (1) pushState or (2) replaceState method.

Affected products

• Apple iPhone OS: before 5.1 (fixed in 5.1)

Published 2012-03-08. Last modified 2026-06-16.