CVE-2016-4676: 
Apple Safari vulnerability analysis and mitigation

A cross-origin vulnerability was discovered in WebKit in Apple Safari before version 10.0.1. The vulnerability was related to the processing of location attributes, which could allow a remote malicious user to obtain sensitive user information. The issue was disclosed and patched in October 2016 (Apple Security).

The vulnerability stemmed from a cross-origin issue with location attributes in WebKit. The security flaw was addressed through improved tracking of location attributes across origins. The issue affected OS X Yosemite v10.10.5, OS X El Capitan v10.11.6, and macOS Sierra 10.12 operating systems (Apple Security, Full Disclosure).

The vulnerability could lead to the disclosure of sensitive user information when processing maliciously crafted web content. This could potentially allow attackers to access information across different origins that should normally be restricted (Apple Security, The Register).

Apple addressed the vulnerability in Safari 10.0.1 through improved tracking of location attributes across origins. Users were advised to update to Safari 10.0.1 through the Mac App Store to protect against this vulnerability (Apple Security).