Apple releases iOS 15.3 RC and macOS Monterey 12.2 RC with a fix for Safari 15's IndexedDB API that leaked users' browser history and Google ID to other sites
Filipe Espósito / 9to5Mac :
Context & Ripple Effects
FingerprintJS disclosed on January 17 that Safari 15's IndexedDB API was handing other sites a copy of each visited site's database name — enough to reconstruct browsing history and pull identifiers like the Google ID — after alerting Apple back on November 28. The IndexedDB leak disclosure landed while Apple's release train was already moving, and this RC is the vehicle carrying the fix to developers before the public build.
The pattern matters as much as the patch: Apple's last emergency Safari hardening was the Spectre-era WebKit update in January 2018, and 2022 has since turned into a drumbeat of browser-engine fixes, with the third actively exploited zero-day patch of the year arriving just weeks after this RC ships.
First-order effects
- Developers and public beta testers get the Safari 15 IndexedDB fix now, closing the channel that exposed browsing history and Google IDs on iOS 15.3 and macOS Monterey 12.2 before the January 27 wide release to all users.
- Safari users on iOS 15 and Monterey 12.2 remain exposed to cross-site database-name reads until they install the final builds, leaving identifiers like the Google ID harvestable in the interim.
Second-order effects
- Privacy-focused rivals and fingerprinting researchers get a fresh proof point: FingerprintJS's disclosure showed a standard web API doubling as a tracking vector, pressuring browser makers to audit IndexedDB-style storage APIs for cross-site leakage.
- Sites and identity providers that rely on browser identifiers for sessions face pressure to assume such identifiers leak, accelerating adoption of defenses that do not depend on client-side storage staying private.
Third-order effects
- The cadence visible here — a November disclosure, a January RC, and then a year of repeated actively exploited WebKit zero-days — points toward Apple treating browser-engine patches as continuous releases rather than point updates, with security response speed becoming a competitive line between browser platforms.
- If standard storage and identifier APIs keep yielding cross-site leaks, expect platform vendors to tighten default partitioning of browser storage, shifting more of the web's tracking economy toward first-party contexts.
The trend: Browser privacy is becoming a patch-cadence race, as researchers keep turning standard web APIs like IndexedDB into fingerprinting vectors faster than platform vendors can harden them.