New Unpatched Apple Safari Browser Bug Allows Cross-Site User Tracking

A software bug introduced in Apple Safari 15’s implementation of
the IndexedDB API could be abused by a malicious website to track
users’ online activity in the web browser and worse, even reveal
their identity.

The vulnerability, dubbed IndexedDB Leaks^[1], was disclosed by fraud
protection software company FingerprintJS, which reported the issue^[2]
to the iPhone maker on November 28, 2021.

IndexedDB is a low-level JavaScript application programming
interface (API) provided by web browsers for managing a NoSQL
database^[3] of structured data
objects such as files and blobs.

“Like most web storage solutions, IndexedDB follows a
same-origin policy,” Mozilla notes in its documentation^[4] of the API. “So while
you can access stored data within a domain, you cannot access data
across different domains.”

Same-origin is a fundamental security mechanism^[5] that ensures that
resources retrieved from distinct origins^[6]
— i.e., a combination^[7]
of the scheme (protocol), host (domain), and port number of a URL —
are isolated from each other. This effectively means that
“https://example[.]com/” and “https://example[.]com/” are not of
the same origin because they use different schemes.

By restricting how a script loaded by one origin can interact
with a resource from another origin, the idea is to sequester
potentially malicious scripts and reduce potential attack vectors
by preventing a rogue website from running arbitrary JavaScript
code to read data from another domain, say, an email service.

But that’s not the case with how Safari handles the IndexedDB
API in Safari across iOS, iPadOS, and macOS.

“In Safari 15 on macOS, and in all browsers on iOS and iPadOS
15, the IndexedDB API is violating the same-origin policy,” Martin
Bajanik said^[8]
in a write-up. “Every time a website interacts with a database, a
new (empty) database with the same name is created in all other
active frames, tabs, and windows within the same browser
session.”

A consequence of this privacy violation is that it allows
websites to learn what other websites a user is visiting in
different tabs or windows, not to mention precisely identify users
on Google services services like YouTube and Google Calendar as
these websites create IndexedDB databases that include the
authenticated Google User IDs, which is an internal identifier that
uniquely identifies a single Google account.

“Not only does this imply that untrusted or malicious websites
can learn a user’s identity, but it also allows the linking
together of multiple separate accounts used by the same user,”
Bajanik said.

To make matters worse, the leakage also affects Private
Browsing^[9] mode^[10] in Safari 15 should a
user visit multiple different websites from within the same tab in
the browser window. We have reached out to Apple for further
comment, and we’ll update the story if we hear back.

“This is a huge bug,” developer advocate for Google Chrome Jake
Archibald tweeted^[11]. “On OSX, Safari users
can (temporarily) switch to another browser to avoid their data
leaking across origins. iOS users have no such choice, because
Apple imposes a ban on other browser engines.”