Apple patched critical WebKit vulnerabilities on OS X three weeks before iOS, exposing users
Apple + Patching = You're Doing It Wrong :( — Apple just released iOS 7.1.1, which contains a bunch of security fixes for a wide range of things. Of particular interest is the list of issues they fixed in WebKit, which includes:
Context & Ripple Effects
This lands at the end of a bruising security week for Apple: on April 22 the company shipped patched iOS and OS X builds for the extremely critical 'triple handshake' cryptography bug that had left iPhone and Mac users open to eavesdropping, alongside a Heartbleed-linked OpenSSL flaw in its current AirPort Extreme and Time Capsule base stations.
Kristin Paget's observation adds a process critique to that run of bugs — the WebKit fixes bundled into iOS 7.1.1 had already been applied to OS X three weeks earlier, so the two platforms were not being patched in step. The syndicated pickup across MacRumors, SecurityWeek and BGR shows how quickly a patch-timing detail became a story about Apple's security discipline, arriving the same day the company reported a record $45.6 billion March quarter driven by iPhone sales — meaning the laggy platform was also its largest.
First-order effects
- iPhone and iPad users ran WebKit code carrying known, critical vulnerabilities for roughly three weeks after Macs received identical fixes, until iOS 7.1.1 closed the gap.
- OS X Safari users were already protected by the time the iOS release landed, making the protection asymmetry between Apple's own platforms visible to anyone comparing advisories.
Second-order effects
- Attackers can diff Apple's OS X WebKit patch to reconstruct what the iOS build still lacks, turning Apple's own desktop fix stream into a roadmap during the window — the same cross-platform urgency that made the April 22 triple-handshake patches span both operating systems.
- Wide pickup by SecurityWeek, BGR and MacRumors puts reputational pressure on Apple's patch process precisely as its record quarter underscores how many devices ride on the delayed mobile pipeline.
Third-order effects
- If shared components like WebKit keep landing in desktop releases ahead of mobile builds, patch timing itself becomes an attack surface, inverting the assumption that Apple's integrated hardware-software control guarantees faster mobile security response.
- Sustained scrutiny of per-platform fix gaps pushes vendors toward synchronized release windows across desktop and mobile, or toward accepting that each staggered patch publicly discloses what sibling platforms remain vulnerable to.
The trend: As operating systems share core engines like WebKit, staggered per-platform patch timing becomes its own vulnerability class, with the larger mobile installed base routinely trailing desktop fixes.