CVE-2016-1728
Description
CSS a:visited button selector in Apple iOS and Safari mishandles height processing, enabling remote attackers to infer visited links via crafted site.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
CSS a:visited button selector in Apple iOS and Safari mishandles height processing, enabling remote attackers to infer visited links via crafted site.
Vulnerability
The Cascading Style Sheets (CSS) implementation in Apple iOS before 9.2.1 and Safari before 9.0.3 mishandles the a:visited button selector during height processing. This allows a crafted website to detect whether a link has been visited by measuring the computed height of the element [1][2].
Exploitation
An attacker hosts a malicious website that uses CSS or JavaScript to query the height of a:visited button elements. When a user visits the site, the browser returns different heights for visited versus unvisited links, enabling the attacker to infer the user's browsing history. No additional user interaction is required beyond visiting the site.
Impact
Successful exploitation results in information disclosure: the attacker gains knowledge of which specific links the user has visited, violating user privacy. The CVSS v3 severity is 4.3 (Medium).
Mitigation
Apple released fixes in iOS 9.2.1 and Safari 9.0.3 [1][2]. Users should update to these versions. For WebKitGTK+ users, the issue is addressed in version 2.16.3 [3]. No other workarounds are known.
AI Insight generated on May 23, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
4cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*range: <=9.0.2
- (no CPE)range: <9.0.3
- Range: <9.2.1
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
9- lists.apple.com/archives/security-announce/2016/Jan/msg00002.htmlnvdVendor Advisory
- lists.apple.com/archives/security-announce/2016/Jan/msg00004.htmlnvdVendor Advisory
- support.apple.com/HT205730nvdVendor Advisory
- support.apple.com/HT205732nvdVendor Advisory
- packetstormsecurity.com/files/136227/WebKitGTK-Memory-Corruption-Denial-Of-Service.htmlnvd
- www.securityfocus.com/archive/1/537771/100/0/threadednvd
- www.securityfocus.com/bid/81263nvd
- www.securitytracker.com/id/1034737nvd
- security.gentoo.org/glsa/201706-15nvd
News mentions
0No linked articles in our index yet.