Information Leaks via Safari's Intelligent Tracking Prevention
This work highlights critical vulnerabilities in a widely used privacy tool, affecting millions of Safari users by compromising their online privacy through unintended tracking and data leaks.
The research identified security and privacy flaws in Apple's Safari Intelligent Tracking Prevention (ITP) mechanism, which inadvertently disclosed users' web browsing habits and enabled persistent cross-site tracking and information leaks, with some issues addressed in updates by December 2019.
Intelligent Tracking Prevention (ITP) is a privacy mechanism implemented by Apple's Safari browser, released in October 2017. ITP aims to reduce the cross-site tracking of web users by limiting the capabilities of cookies and other website data. As part of a routine security review, the Information Security Engineering team at Google has identified multiple security and privacy issues in Safari's ITP design. These issues have a number of unexpected consequences, including the disclosure of the user's web browsing habits, allowing persistent cross-site tracking, and enabling cross-site information leaks (including cross-site search). This report is a modestly expanded version of our original vulnerability submission to Apple (WebKit bug #201319), providing additional context and edited for clarity. A number of the issues discussed here have been addressed in Safari 13.0.4 and iOS 13.3, released in December 2019.