A bug in WebKit allows websites to read IndexedDB database names, potentially leaking user browsing history and enabling cross-site tracking in Safari.

Discovery of a Privacy Leak in Apple’s Browser Engine

Security researchers at FingerprintJS identified a data leakage issue in WebKit, which powers Apple’s browser ecosystem. Some services embed unique user IDs in database names, which can act like a persistent tracking mechanism across websites.

Safari and All iOS Browsers Are Affected

The vulnerability impacts Safari on macOS, iOS, and iPadOS, as well as all third-party iOS browsers due to Apple’s WebKit requirement. Even without accessing stored data, attackers can infer browsing behavior and visited services from database name patterns.

Understanding Web Storage in Modern Browsers

Modern browsers store data using cookies, Web Storage, and IndexedDB to maintain sessions, preferences, and app data locally. This leakage can contribute to browser fingerprinting, allowing attackers to build partial profiles of user activity.

IndexedDB: Designed for Large-Scale Local Storage

IndexedDB is a browser-based database system used to store large structured data efficiently for web applications. While no passwords or direct content are exposed, metadata alone can still significantly reduce user anonymity.

Same-Origin Policy Is Meant to Protect Data

Browsers enforce the Same Origin Policy to ensure websites can only access their own stored data, preventing cross-site data leaks. On iOS, all browsers use WebKit, so switching browsers does not eliminate the issue.

The Core Bug: Exposure of Database Names

The issue arises because IndexedDB allows listing database names via indexedDB.databases(), even across different websites. Users can reduce exposure by periodically clearing Safari website data, though this is inconvenient and temporary.

Why Database Names Matter for Privacy

Although the contents remain protected, database names themselves can reveal sensitive information such as user identity patterns or service usage.