Three XSS vulnerabilities discovered in ProtonMail for iOS: one via SVG onload in applewebdata origin, one via javascript URI requiring click interaction, and one via base64-encoded HTML embed in data origin. While XSSs do not allow email exfiltration, they enable JavaScript execution, privacy violations through tracking, phishing, and UXSS in privileged contexts.
Firefox iOS QR code scanner fails to sanitize javascript: URIs, allowing XSS attacks across multiple contexts including reader mode, local files, and internal pages, while also bypassing Content Security Policy restrictions. The vulnerability was fixed by removing javascript URI support from the address bar in later versions.
A Safari extension developer who filed 82 new Safari bugs in 2025 through WebKit Bugzilla and Apple Feedback Assistant shares statistics showing only ~32 were fixed, and argues Safari's software quality is deteriorating based on increasing unfixed bug accumulation.