Apple iPhone 17 Pro
AFP via Getty Images

iOS 26.3.1 (a): Apple’s Hidden iPhone Update Recommended For Hundreds Of Millions Of Users

19 Mar 2026, 14:03 · Yahoo Tech

This post, first published on Wednesday, March 18, was updated on Thursday, March 19 with more information about the first Background Security Improvement update.

Apple released its first-ever Background Security Improvement update for the iPhone, called iOS 26.3.1 (a), with corresponding ones for iPad and Mac. It’s aimed at addressing a vulnerability in the iPhone, but it appears in a different way on the iPhone from standard software releases. Here’s how to find and install it — and it’s not in the place you’re expecting to find it.

The Evolution Of ‘Silent’ Security Patching

Three years ago, Apple had a different process for urgent updates with a security focus, called Rapid Security Responses. These were retired and earlier this year Apple put the framework in place for BSI updates instead.

Which iPhones Can Run iOS 26.3.1 (a)?

Although it’s a novel kind of release, it is for all iPhones from the iPhone 11 onwards, that is, all iPhones released from 2019 to now. The second-generation and third-generation iPhone SE handsets are included. All members of the iPhone 17 series, plus iPhone Air, are also supported.

Apple’s notes say that this BSI “provides additional protection and is recommended for all users,” which means the hundreds of millions of iPhones compatible with iOS 26. “Background Security Improvements deliver important security improvements between software updates,” the company said in a support document.

How To Download And Install iOS 26.3.1 (a)

Crucially, this update is not in the same place as where you’ll find regular updates. Open the Settings app on the iPhone and scroll down to Privacy & Security. Right at the bottom you’ll see Background Security Improvements. Click this there’s an option to Automatically Install. However, this isn’t always the quickest way for it to arrive. If there is a new BSI, you can choose to download it. On my iPhone 17 Pro Max. It downloaded and installed quickly — less than 5 minutes in all.

Note that unlike regular updates, once it’s installed, you can remove it. To do this, click on the “i” to the right of the BSI and an option appears to remove it and restart the phone.

iOS 26.3 .1 (a) — What’s In The Release

In the support page mentioned above, Apple said that this BSI was designed to address an issue in WebKit, the open-source browser engine that displays web content in apps.

Advertisement
Advertisement

The issue, tracked as CVE-2026-20643, is a "cross-origin" flaw in the Navigation API. It deals with maliciously crafted web content that could allow an attacker to bypass the Same Origin Policy and potentially access sensitive data from other open tabs. This has been addressed in this update with what Apple calls “improved input validation.” Because WebKit powers Safari and in-app browsers, this is considered an urgent fix for all users.

About our ads