Apple has released its first ever real-world Background Security Improvement (BSI) update today — patching a WebKit vulnerability across iPhone, iPad, and Mac. This marks a milestone: the first time Apple has used its new silent security update system to deliver an actual fix rather than just test the delivery infrastructure.
What Was Fixed
The update addresses a WebKit vulnerability that could allow maliciously crafted web content to bypass the Same Origin Policy — a fundamental browser security mechanism that prevents one website from reading data from another. Apple says the vulnerability was addressed with improved input validation. Since every browser on iPhone and iPad uses WebKit, this affects all users regardless of which browser they prefer.
Updates Available Today
- iOS 26.3.1 — all iPhones on iOS 26
- iPadOS 26.3.1 — all iPads on iPadOS 26
- macOS Tahoe 26.3.1 — all Macs except MacBook Neo
- macOS Tahoe 26.3.2 — exclusive to MacBook Neo (different hardware architecture)
Why This Is Significant
This is the first time Apple has used Background Security Improvements to ship an actual security fix. The system has been built into all devices since iOS/iPadOS/macOS 26.1, and Apple ran testing rounds in the January beta cycle, but today marks its first production use.
The key advantage is speed. Rather than waiting weeks for a full point release to patch a WebKit flaw, Apple can now push a targeted fix to hundreds of millions of devices within days of discovering a vulnerability — the kind of rapid response that browser engine flaws demand, since they’re among the most actively exploited in the wild.
This replaces the old Rapid Security Response system from iOS 16, which was rarely used and retired after a 2023 incident where an RSR update broke website loading for some users.
How to Install
If “Automatically Install” is enabled (the default), the update has likely already been applied silently. To check or install manually:
- iPhone/iPad: Settings → Privacy & Security → Background Security Improvements → Install
- Mac: Apple Menu → System Settings → Privacy & Security → Background Security Improvements → Install
If you skip the BSI, you’ll receive the same fix in the next standard software update. And unlike any previous Apple update, if you run into compatibility issues you can remove it directly from the same Settings screen — a first for Apple’s update system.
Should You Install It?
Yes, right away. A Same Origin Policy bypass in WebKit is a serious flaw that could allow a malicious website to read data from other tabs or sites you’re logged into. BSI updates are fast, lightweight, and reversible — there’s no reason to wait.
