In summary:
- Macworld reports Apple released urgent security updates overnight for iOS, iPadOS, and macOS to address a critical WebKit vulnerability.
- These “Background Security Improvements” fix CVE-2026-20643, a same-origin policy bypass that could expose devices to exploitation.
- Users should immediately install iOS 26.3.1, iPadOS 26.3.1, and macOS 26.3.1/26.3.2 updates to maintain device security.
Apple has released an update to iOS 26.3.1, iPadOS 26.3.1, macOS 26.3.1, and macOS 26.3.2 (currently a MacBook Neo-only version). The update is part of Apple’s Background Security Improvements feature in its newest operating systems, which used to be called Rapid Security Responses. The update doesn’t appear in Software Update.
According to an Apple support document, the update contains a single fix for a WebKit vulnerability (WebKit is the engine used by Safari and other software with web access). The vulnerability involves WebKit’s same-origin policy, which is a mechanism that manages how data is used based on the origin of a website. A malicious user could figure out a way to bypass WebKit’s SOP, but the update fixes that. The vulnerability was documented as CVE-2026-20643 in the Common Vulnerabilities and Exposures database.
The update has been labeled iOS 26.3.1 (a), iPadOS 26.3.1 (a), macOS 26.3.1 (a), and macOS 26.3.2 (a) by Apple. It appears in Settings/System Settings > Privacy & Security > Background Security Improvements, and you can manually install it here if it hasn’t been installed already. If you’ve opted to automatically install regular software updates, Background Security Improvements will also be set to automatically install, but you can change the toggle here as well.
Adam Boynton of Jamf, a software company specializing in device management and security, issued a statement regarding the update: “For organizations, it’s crucial to ensure this update is issued immediately, as any postponements will leave devices and operations vulnerable. More importantly, users should set updates to be issued automatically, so there’s no window for attackers to exploit.”
Background Security Improvements are updates that Apple issues between its regular update cycle. They are usually security patches that Apple wants to issue immediately without waiting weeks or months for a regular software update.
Author: Roman Loyola, Senior Editor, Macworld
Roman is a Macworld Senior Editor with over 30 years of experience covering the tech industry, focusing on the Mac and other products in the Apple ecosystem. He is also the host of the Macworld Podcast. His career started at MacUser, where he received Apple certification as a repair technician (when Apple did that kind of thing). He's also worked for MacAddict, MacLife, and TechTV.