Apple has just released a surprise update to Big Sur, bringing it to version 11.3.1. According to its security release notes, this fixes two serious vulnerabilities in WebKit, in which crafted web content could lead to arbitrary code execution. In both cases, Apple is aware of reports that these vulnerabilities may have been actively exploited. This update is therefore essential for anyone running Big Sur.

Although it apparently addresses just these two vulnerabilities, it’s still 3.3 GB for an M1 Mac and 2.4 GB for an Intel model.

Once again, this update may downgrade XProtect to version 2144 and MRT to 1.75. If those don’t update immediately afterwards, you may need to force updates with SilentKnight.

This is indeed a minor update to Big Sur: there are no changes apparent in the bundled apps, and the only items in /System/Library which have changed build or version number are:

• JavaScriptCore, SafariServices and WebKit frameworks, increments in build from 16611.1.21.161.3 to 16611.1.21.161.6
• Safari, WebDriver and WebInspector private frameworks, the same increments in build number
• Safari Templates, the same increments in build number
• CloudBookmarksAccountsNotifier and SafariSupport bundles, the same increments in build number

These are consistent with the only changes being in Safari support and WebKit, as implied by the security release notes.

M1 Macs using bootable external disks should find this an interesting test. I have already updated the internal SSD of my M1 Mac mini to 11.3.1, and tried restarting using my two external bootable SSDs still with 11.3 installed, so I could try updating them using Software Update.

My Samsung X5 (Thunderbolt 3) couldn’t be used to boot at all: first macOS claimed there were no authorised users, then when I selected and authorised one, restarting from that external SSD threw the Mac into Recovery, which advised that macOS needed to be reinstalled on the external disk. The only option there appears to be to download the full installer and hope that works.

I connected my SATA/USB-C SSD to a USB-A port, and the Mac mini rebooted happily from that copy of 11.3 on the external disk, and downloaded the 11.3.1 update using Software Update. This then installed correctly, and both the external and internal SSDs now boot correctly into 11.3.1.

Thanks to the ever watchful Mr Macintosh for alerting us.
Updated at 2330 UTC 3 May 2021, with info on M1 external bootable SSDs.