CVE-2014-1346: Apple Safari

Medium severity, CVSS 5.0. EPSS: 1.9% chance of exploitation in the next 30 days.

WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, does not properly interpret Unicode encoding, which allows remote attackers to spoof a postMessage origin, and bypass intended restrictions on sending a message to a connected frame or window, via crafted characters in a URL.

Affected products

• Apple Safari: up to and including 6.1.3; version 6.0 only; version 6.0.1 only; version 6.0.2 only; version 6.0.3 only; version 6.0.4 only; …

Published 2014-05-22. Last modified 2026-06-17.