Apple Debuts Background Security Improvements With Fresh WebKit Patches
Apple on Tuesday introduced a new security update mechanism for the latest mobile and desktop platforms to deliver protections at a faster pace.
Called Background Security Improvements, the feature debuted with a fresh round of WebKit patches but supports other platform components as well.
“Background Security Improvements deliver additional security protections between software updates,” the tech giant explains.
The new mechanism is designed to deliver lightweight security fixes for components such as Safari, WebKit, and various system libraries “that benefit from smaller, ongoing security patches”, it notes.
Currently, the feature is supported and enabled in iOS 26.1, iPadOS 26.1, and macOS 26.1. Future platform iterations will also support it, but Apple warns that the mechanism could be disabled if it causes problems.
“In rare instances of compatibility issues, Background Security Improvements may be temporarily removed and then enhanced in a subsequent software update,” Apple says.
Users can access and modify the Background Security Improvements settings from the Privacy and Security menu. To benefit from the feature, users should make sure the ‘Automatically Install’ option is turned on.
The improvements will not be rolled out to devices with the option turned off until a regular security update is delivered.
“If a Background Security Improvement has been applied, and you choose to remove it, your device reverts to the baseline software update (for example, iOS 26.3) with no Background Security Improvements applied,” Apple explains.
The first lightweight security protections delivered using this mechanism target CVE-2026-20643, described as a cross-origin bug in WebKit that could be exploited through malicious web content.
The security defect, Apple notes in its advisory, impacted the Navigation API and was addressed with improved input validation.
The update was pushed out as iOS 26.3.1 (a), iPadOS 26.3.1 (a), macOS 26.3.1 (a), and macOS 26.3.2 (a).
This article was published by Security Week. Please check their website for the original content.
