CVE-2016-4676: Apple Mac OS X

High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days.

A Cross-origin vulnerability exists in WebKit in Apple Safari before 10.0.1 when processing location attributes, which could let a remote malicious user obtain sensitive information.

Affected products

• Apple Mac OS X: version 10.10.5 only; version 10.11.6 only; version 10.12 only
• Apple Safari: before 10.0.1 (fixed in 10.0.1)

Published 2020-02-03. Last modified 2026-06-17.