There was a recently discovered issue with how the IndexedDB API was implemented in Safari's WebKit engine.
This gives IT professionals who work in an environment dominated by Apple products heartburn. In addition, the faulty implementation allows or could allow attackers to intercept leaking browser activity in real time, including the user IDs associated with vulnerable machines.
Indexed DB is a commonly used API with a robust client-side storage system with no capacity limits. It is usually used for caching web application data so users can view it offline later, but of course, it can also be used to store sensitive information.
IndexedDB developers followed the "same-origin" policy to prevent data leaks, which controls which resources are allowed to access each piece of data.
Unfortunately, researchers at FingerprintJS discovered that the IndexedDB API doesn't follow the same-origin policy used by Safari 15 on macOS, and the difference in approach could lead to the disclosure of sensitive information.
To be impacted by this issue, a user has to log onto websites like YouTube and Facebook or visit service portals like Google Keep or Google Calendar. Doing so creates a new IndexedDB database and appends the Google Username.
According to the researchers who first discovered the bug:
"We checked the homepages of Alexa's Top 1000 most visited websites to understand how many websites use IndexedDB and can be uniquely identified by the databases they interact with.
The results show that more than 30 websites interact with indexed databases directly on their homepage without additional user interaction or needing to authenticate. We suspect this number to be significantly higher in real-world scenarios as websites can interact with databases on subpages, after specific user actions, or on established page parts."
Worst of all, there's no good mitigation strategy here. Disabling all JavaScripts would work but would almost certainly cause other applications to fail that your organization relies on to. So we're waiting on Apple to provide a fix. The good news is that they have a solid reputation for responsiveness, so we should not stay long.
