Here is a theory: Apple’s response here might have been slow because they misdirected the bug. This is a web stored XSS vulnerability. It has nothing to do with

Here is a theory: Apple’s response here might have been slow because they misdirected the bug. This is a web stored XSS vulnerability. It has nothing to do with the AirTag, other than that the page is related to that device. If during the triage they accidentally sent the bug to the team who developed the AirTag’s firmware then they might have got confused and didn’t handle the ticket appropriately. Obviously this is not an excuse and a big company should know better, but can explain why the handling was sub-optimal. Just look at this very forum and the amount of confusion present in the comments. There are people questioning if a stored XSS is really that bad (yes it is), or asking why browsers don’t validate the inputs by default (wouldn’t help). There is nothing wrong with these questions! The problem and the solution is obvious to someone who worked on web security before, but if this is the first time you are wrapping your mind around the concept you might mess things up. Same way as if a web developer is asked to fix a kernel level buffer overflow, they won’t have the right mental toolset to understand the problem, let alone the ability to fix it.