In early 2022, security researchers uncovered a serious vulnerability—CVE-2022-22637—that could allow a malicious website on Safari to bypass cross-origin restrictions. This issue, stemming from a logic bug in Apple’s WebKit engine, threatened user privacy and raised the risk of data leaks across several Apple platforms. This long read will explain the bug, show a simplified proof of concept, detail how Apple fixed it, and link to original resources so you can dig even deeper.

The Issue in Plain English

Normally, browsers keep different websites (“origins”) separated for security. For example, a website you visit can’t just grab data from your bank’s website, because their origins are different. This is called the Same-Origin Policy.

However, the logic flaw at the heart of CVE-2022-22637 allowed a website to bypass these barriers under certain circumstances. That means a crafted malicious page could interact with, and maybe steal data from, other sites you were logged into—without your consent.

Apple’s advisory summarized it

> A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iOS 15.4 and iPadOS 15.4, tvOS 15.4.  
> *A malicious website may cause unexpected cross-origin behavior.*

Where Was the Bug?

The flaw lived deep inside WebKit, the browser engine used by Safari (and also by all browsers on iOS and iPadOS). Specifically, a state management bug could let one website access information from another, in situations that should have been blocked.

While Apple didn’t publish the most technical breakdown, based on WebKit changes and community research, we know this involved “state confusion” when managing session data and security contexts.

Imagine this pseudocode for a web browser's internal logic

// Simplified logic for determining access
if (state.origin == requested.origin) {
    allow();
} else {
    deny();
}

Due to a logic error (say, an outdated state being checked), the code might skip the permit check occassionally:

// Flawed logic: uses cached or outdated state
if (cachedState.origin == requested.origin) {
    allow();
} else {
    deny();
}

If cachedState.origin wasn't updated properly, a malicious site could act as if it was your bank or another site—at least for a moment.

Proof-of-Concept: What Could an Attacker Do?

The public details are scarce, but here’s a simplified example closest to the logic flaw.

Suppose a site tricks the browser into reusing an internal state from a previous site, then tries to fetch sensitive information.

Here’s some JavaScript that demonstrates a (non-malicious) cross-origin request that would normally fail:

// Attempt to fetch from another origin—should be blocked!
fetch("https://mybank.com/private/data";, {
  credentials: "include"
})
.then(response => response.text())
.then(data => {
  console.log("Fetched data:", data);
})
.catch(e => {
  console.error("Error (as expected):", e);
});

If the logic flaw is present, however, and a malicious site tricks the browser into confusing the origins, this request may unexpectedly succeed—letting the attacker read private info.

> ⚠️ Note: The exploit in the wild would combine timing, history manipulation, or pop-up interactions to trigger this state confusion.

tvOS (prior to 15.4)

As all iOS and iPadOS browsers are forced to use WebKit, users on any browser were at risk on these platforms.

Remediation: How Apple Fixed It

Apple fixed CVE-2022-22637 by updating how the browser tracks “origin state.” This improved mechanism makes sure that the state can't be confused or reused by accident. In a nutshell, every interaction now double-checks and locks-in origins before granting access, closing the window for attackers.

Safari 15.4+

- iOS/iPadOS 15.4+

Original References

- Apple Security Updates – CVE-2022-22637
- WebKit Commit Tracking CVE-2022-22637
- MITRE CVE Details for CVE-2022-22637

Key Takeaways

- CVE-2022-22637 was a cross-origin logic flaw in WebKit, allowing a malicious website to potentially steal sensitive info.

Apple fixed it quickly, and users should update to the latest software.

- The vulnerability highlights the ongoing importance of strict state and session management in browsers.

Final Advice

Don’t delay software updates. Vulnerabilities like CVE-2022-22637 can be exploited silently and at scale, especially when a single bug affects all browsers on a popular platform.

If you’d like to learn more or keep your team updated, bookmark Apple’s security releases page.

Timeline

Published on: 09/23/2022 19:15:00 UTC
Last modified on: 09/28/2022 12:21:00 UTC