WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly perform taint checking for CANVAS elements, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive image data by leveraging a redirect to a data:image resource.
https://support.apple.com/kb/HT205033
https://support.apple.com/kb/HT205030
http://www.securitytracker.com/id/1033274
http://www.securityfocus.com/bid/76341
http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html
http://lists.apple.com/archives/security-announce/2015/Aug/msg00000.html