CVE-2022-22594

What it actually does

Cross-origin validation flaw in IndexedDB API allows a website to read or track data from other origins, bypassing same-origin policy protections.

Why it matters to the business

Attackers can obtain sensitive user information such as browsing history or stored data across sites, leading to privacy violations, regulatory exposure, and loss of user trust.

How an attack unfolds

An attacker hosts a malicious website that loads in the victim's browser and uses crafted IndexedDB operations to extract or track cross-origin data due to insufficient input validation.

How to fix it

Update affected Apple products to the versions that contain the fix: iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. Apply updates immediately across all managed devices.

How to confirm the fix worked

Confirm devices are running the listed fixed versions or newer. Review browser release notes and device update history for the presence of the IndexedDB input validation changes.

Typical attack path

1. Victim is tricked into visiting an attacker-controlled website.
2. Malicious page issues IndexedDB API calls that exploit the cross-origin flaw.
3. Sensitive data from other origins is read or tracked without user interaction beyond page load.
4. Attacker exfiltrates the collected information to a remote server.

How to detect it

Examine browser process logs, network traffic for unexpected cross-origin IndexedDB-related requests, and any evidence of data exfiltration from browser storage after visiting untrusted sites.

What your security team should do

• Prioritize patching all affected Apple devices and browsers to the fixed releases.
• Monitor vendor security bulletins for any related follow-on issues.
• Enforce automatic updates where possible and audit for outdated systems.