CVE-2018-4278: Apple iCloud

Medium severity, CVSS 4.3. EPSS: 2.3% chance of exploitation in the next 30 days.

In Safari before 11.1.2, iTunes before 12.8 for Windows, iOS before 11.4.1, tvOS before 11.4.1, iCloud for Windows before 7.6, sound fetched through audio elements may be exfiltrated cross-origin. This issue was addressed with improved audio taint tracking.

Affected products

• Apple iCloud: before 7.6 (fixed in 7.6)
• Apple iPhone OS: before 11.4.1 (fixed in 11.4.1)
• Apple iTunes: before 12.8 (fixed in 12.8)
• Apple Safari: before 11.1.2 (fixed in 11.1.2)
• Apple tvOS: before 11.4.1 (fixed in 11.4.1)
• Canonical Ubuntu Linux: version 16.04 only; version 18.04 only

Published 2019-01-11. Last modified 2026-06-17.