Wired
According to a blog post shared on Friday by browser fingerprinting service provider FingerprintJS, a bug in WebKit’s JavaScript API called IndexedDB could reveal a user’s recent browsing history and even identities, MacRumors reported.
The bug allows any website using IndexedDB to access the name of the IndexedDB database generated by another website during a user’s browsing session. This vulnerability could allow a website to track other websites a user visits, since each website’s database name is usually unique. The correct behavior should be that the website can only access its own IndexedDB database.
According to FingerprintJS, the database created by YouTube contains authenticated Google user IDs, an identifier that can be used with Google APIs to obtain personal information about users such as avatars.
According to reports, the bug will affect new versions of browsers that use Apple’s open source browser engine WebKit, including Safari 15 for Mac and all versions of Safari for iOS 15 and iPadOS 15. The vulnerability also affects third-party browsers such as Chrome on iOS 15 and iPadOS 15, as Apple requires all browsers to use WebKit on iPhones and iPads. The FingerprintJS demo shows that older browsers like Safari 14 for Mac are not affected.