[CVE-2016-1764] If You Can't Break Crypto, Break the Client: Recovery of Plaintext iMessage Data

CVE

CVE-2016-1764

Published

2016-04-08 00:00

Collected

2026-07-08 08:43

---
id: 4258
title: "[CVE-2016-1764] If You Can't Break Crypto, Break the Client: Recovery of Plaintext iMessage Data"
cve: CVE-2016-1764
source_domain: bishopfox.com
source_url: "https://bishopfox.com/blog/break-client-recovery-of-plaintext-imessage-data"
published_at: "2016-04-08T00:00:00Z"
tags: ["xss", "macos", "apple", "imessage", "cve-2016-1764"]
phying_url: "https://phying.com/item/4258"
lang: en
---

# [CVE-2016-1764] If You Can't Break Crypto, Break the Client: Recovery of Plaintext iMessage Data

## Summary

Technical write-up of CVE-2016-1764: a JavaScript URI plus the missing same-origin policy in OS X Messages' embedded WebKit let attackers exfiltrate entire iMessage histories with one click.

## Intelligence Metadata

- **Sources:** bishopfox.com
- **CVE:** CVE-2016-1764
- **Published:** 2016-04-08T00:00:00Z
- **Original:** https://bishopfox.com/blog/break-client-recovery-of-plaintext-imessage-data
- **Phying News:** https://phying.com/item/4258