About the security content of Safari 9.1 - Apple Support

Linked CVE reports

These are source relationships, not a claim that this article fixes every affected product or branch.

• CVE-2009-2197n/a: security vulnerability
• CVE-2016-1864n/a: Exposure of Sensitive Information to an Unauthorized Actor
• CVE-2016-1785n/a: Exposure of Sensitive Information to an Unauthorized Actor
• CVE-2016-1784n/a: Uncontrolled Resource Consumption
• CVE-2016-1779WebKit in Apple iOS before 9.3 and Safari before 9.1 allows remote attackers to bypass the Same Origin Policy and obtain physical-location data via a crafted geolocation request
• CVE-2016-1778WebKit in Apple iOS before 9.3 and Safari before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site
• CVE-2016-1786n/a: Exposure of Sensitive Information to an Unauthorized Actor
• CVE-2016-1783n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-1781WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles attachment URLs, which makes it easier for remote web servers to track users via unspecified vectors
• CVE-2016-1772The Top Sites feature in Apple Safari before 9.1 mishandles cookie storage, which makes it easier for remote web servers to track users via unspecified vectors
• CVE-2016-1771The Downloads feature in Apple Safari before 9.1 mishandles file expansion, which allows remote attackers to cause a denial of service via a crafted web site
• CVE-2016-1782n/a: Improper Access Control

Source and provenance

Original title: About the security content of Safari 9.1 - Apple Support. Captured 17 Oct 2026, 14:11 UTC. The stored article is used for enrichment and change detection; BlackTree does not republish the publisher's full text here.