Apple Security Updates

WebKit CVEs from Apple's Safari security release pages, cross-referenced to the public WebKit fix commit and, when covered, to the WebKit Weekly analysis of that fix.

Matching is by WebKit Bugzilla number — Apple exposes it on every WebKit CVE entry, and WebKit commits include the same ID as a bugs.webkit.org/show_bug.cgi?id=… reference. Unmatched CVEs are shown too: they usually mean the fix commit is still under Bugzilla embargo.

5 Safari releases 49 WebKit CVEs 40 matched to a commit 40 covered in a report

Safari 27 September 14, 2026 · 3 WebKit CVEs ·3 covered ↗

CVE-2026-84635

Processing maliciously crafted web content may lead to an unexpected process termination

A logic issue was addressed with improved state management.

Bugzilla 310457 Commit 9654ed7d9e · 2026-03-26 Analysis

Credit: Souta Sugiyama

CVE-2026-64753

Processing maliciously crafted web content may disclose sensitive user information

A permissions issue was addressed by removing the vulnerable code.

Bugzilla 315121 Commit 71730beeaf · 2026-06-27 Analysis

Credit: Viggo Lekdorf

CVE-2026-86898

Opening a maliciously crafted webarchive file may lead to universal cross-site scripting

A logic issue was addressed with improved state management.

Bugzilla 318271 Commit ecb5a7bf75 · 2026-07-13 Analysis

Credit: Tomi Garcia (archyxsec)

Safari 26.6.1 August 18, 2026 · 11 WebKit CVEs ·8 covered ↗

CVE-2026-64784 IntegerOverflow

Processing maliciously crafted web content may lead to an unexpected Safari crash

An out-of-bounds access issue was addressed with improved bounds checking.

Bugzilla 317632 Commit 97df94ead0 · 2026-08-24 Analysis

Credit: Janggoon Lee of Out of Bounds, OpenAI Codex Security - Amy Burnett

CVE-2026-43795 OOB

Processing maliciously crafted web content may lead to an unexpected Safari crash

The issue was addressed with improved memory handling.

Bugzilla 313452 Commit 79d7541f83 · 2026-09-09 Analysis

Credit: wwwlk

CVE-2026-65341 IntegerOverflow

Processing maliciously crafted web content may lead to memory corruption

The issue was addressed with improved memory handling.

Bugzilla 318405 Commit 28da9c5a83 · 2026-09-10 Analysis

Credit: Henock Habte

CVE-2026-64782

Processing maliciously crafted web content may lead to an unexpected Safari crash

A memory corruption vulnerability was addressed with improved locking.

Bugzilla 321480 Fix not yet public

Credit: Charles Kern, Seonwook Kim, Shubham Chaskar, lattice, Josef Korbel

CVE-2026-64781

Processing maliciously crafted web content may lead to an unexpected Safari crash

The issue was addressed with improved input validation.

Bugzilla 321484 Fix not yet public

Credit: Thomas Guillem

CVE-2026-65351

Processing maliciously crafted web content may lead to an unexpected Safari crash

This issue was addressed through improved state management.

Bugzilla 321517 Fix not yet public

Credit: Niels Hofmans

CVE-2026-64715 UAF

Processing maliciously crafted web content may lead to an unexpected process crash

A use-after-free issue was addressed with improved memory management.

Bugzilla 316347 Commit 1d5c10e2f9 · 2026-08-24 Analysis

Credit: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative

CVE-2026-64780 MemoryCorruption

Processing maliciously crafted web content may lead to an unexpected Safari crash

The issue was addressed with improved checks.

Bugzilla 316918 Commit 9a17cd1100 · 2026-08-26 Analysis

Credit: OpenAI Codex Security - Amy Burnett

CVE-2026-65334 TypeConfusion

Processing maliciously crafted web content may lead to an unexpected Safari crash

A memory corruption issue was addressed with improved state management.

Bugzilla 316791 Commit 9f07374e9e · 2026-08-23 Analysis

Credit: OpenAI Codex Security - Amy Burnett

CVE-2026-43794 Race

Processing maliciously crafted web content may lead to memory corruption

A memory corruption issue was addressed with improved memory handling.

Bugzilla 317317 Commit d4a150e51b · 2026-08-30 Analysis

Credit: Dung Do (@_piers2) of Calif.io

CVE-2026-64787 UAF

Processing maliciously crafted web content may lead to an unexpected process termination

A use-after-free issue was addressed with improved memory management.

Bugzilla 313703 Commit cb83583e5f · 2026-07-01 Analysis

Credit: 杉山壮太, Shubham Chaskar

Safari 26.6 July 27, 2026 · 7 WebKit CVEs ·7 covered ↗

CVE-2026-64713 InfoDisclosure

Websites may know if the user has visited a given link

This issue was addressed with improved checks.

Bugzilla 316827 Commit 52cacff4c9 · 2026-06-11 Analysis

Credit: Kwak Kiyong, Song Nuri

CVE-2026-64730 LogicError

Visiting a website that frames malicious content may lead to UI spoofing

The issue was addressed with improved UI.

Bugzilla 311660 Commit 1ab2bb4ff3 · 2026-08-13 Analysis

Credit: Kagami Rosylight of Mozilla

CVE-2026-64728 CrossOrigin

Maliciously crafted web content may violate iframe sandboxing policy

A permissions issue was addressed with improved validation.

Bugzilla 313220 Commit c52bbb5187 · 2026-08-21 Report: 2026-W33

Credit: an anonymous researcher

CVE-2026-64783 UAF

Processing maliciously crafted web content may lead to an unexpected Safari crash

A use-after-free issue was addressed with improved memory management.

Bugzilla 313521 Commit be08720593 · 2026-08-12 Report: 2026-W32

Credit: Luke Francis, Francisco Alonso (@revskills), Shubham Chaskar, Jiyong Yang (@Sy2n0), 杉山壮太, lattice, Behzad Najjarpour Jabbari (@_G4ru_), Junyeong Lee, Mooth.ai, OGINOME Tomohito, Using GLM From Z.AI, Gia Bui (@yabeow) from Calif.io

CVE-2026-64757 MemoryCorruption

Processing maliciously crafted web content may lead to an unexpected Safari crash

A memory corruption issue was addressed with improved state management.

Bugzilla 315082 Commit 72272dcc4f · 2026-05-19 Report: 2026-W20

Credit: Milad Nasr and Nicholas Carlini with Claude, Anthropic

CVE-2026-43804 LogicError

Visiting a website may lead to an app denial-of-service

This issue was addressed through improved state management.

Bugzilla 316816 Commit a37a650575 · 2026-09-10 Analysis

Credit: Heiko Kiesel of SEEMOO, TU Darmstadt

CVE-2026-43821 AuthBypass

An app may be able to read files outside of its sandbox

An access issue was addressed with improved access restrictions.

Bugzilla 314867 Commit 74d0c628ff · 2026-07-02 Analysis

Credit: Brian Carpenter

Safari 26.5.2 June 29, 2026 · 17 WebKit CVEs ·13 covered ↗

CVE-2026-43700 CrossOrigin

Processing maliciously crafted web content may disclose sensitive user information

A cross-origin issue was addressed with improved tracking of security origins.

Bugzilla 315368 Commit 67b563b85f · 2026-06-29 Analysis

Credit: Vitaly Simonovich, Christian Meurer Xavier

CVE-2026-43735

A malicious website may exfiltrate data cross-origin

The issue was addressed with improved checks.

Bugzilla 313357 Fix not yet public

Credit: Gurpreet Shergill, Merrick Hare, Drinor Selmanaj (Sentry), Khai Tran, John Lussier, Rhyru9, Kwak Kiyong, Song Nuri

CVE-2026-43734

Processing maliciously crafted web content may lead to an unexpected process crash

A use-after-free issue was addressed with improved memory management.

Bugzilla 313693 Fix not yet public

Credit: Jonathan Alush-Aben

CVE-2026-43732 AuthBypass

Processing maliciously crafted web content may disclose sensitive user information

A path handling issue was addressed with improved validation.

Bugzilla 313085 Commit 5be1236842 · 2026-07-02 Analysis

Credit: Nan Wang (@eternalsakura13)

CVE-2026-43731 Race

Processing maliciously crafted web content may lead to memory corruption

A use-after-free issue was addressed with improved memory management.

Bugzilla 314115 Commit 866892a305 · 2026-07-01 Analysis

Credit: dr3dd

CVE-2026-43727 UAF

Processing maliciously crafted web content may lead to an unexpected Safari crash

A use-after-free issue was addressed with improved memory management.

Bugzilla 313691 Commit c5036aadbd · 2026-07-01 Analysis

Credit: Tommy DeVoss from Braze Security Team (@thedawgyg), Gia Bui (@yabeow) from Calif.io, Gurpreet Shergill

CVE-2026-43725 AuthBypass

A malicious website may be able to process restricted web content outside the sandbox

The issue was addressed with improved input validation.

Bugzilla 312832 Commit ccf0c4874c · 2026-07-07 Report: 2026-W27

Credit: Luke Francis

CVE-2026-43663 UAF

Processing maliciously crafted web content may lead to an unexpected process crash

The issue was addressed with improved memory handling.

Bugzilla 312781 Commit 13bfbf94f4 · 2026-06-29 Analysis

Credit: stratan (@5tratan) of Almamater Technologies, Soyeon Park, Amy Burnett, Khai Tran, sherkito, Kota Toda, HexRabbit (@h3xr4bb1t) and NiNi (@terrynini38514) of DEVCORE Research Team, Using GLM From Z.AI, Tristan Madani (@TristanInSec) from Talence Security, Brian Carpenter

CVE-2026-43716 UAF

Processing maliciously crafted web content may lead to an unexpected Safari crash

The issue was addressed with improved memory handling.

Bugzilla 313473 Commit a012babd4f · 2026-06-29 Analysis

Credit: Maher Azzouzi, Tuan and Duc from Calif.io, OpenAI Codex Security - Amy Burnett, Evan Lambert

CVE-2026-43676

Processing maliciously crafted web content may lead to an unexpected Safari crash

An out-of-bounds access issue was addressed with improved bounds checking.

Bugzilla 317231 Fix not yet public

Credit: Mateusz Krzywicki (iVerify.io), dr3dd, Tommy DeVoss from Braze Security Team (@thedawgyg)

CVE-2026-43740

Processing maliciously crafted web content may result in the disclosure of process memory

The issue was addressed with improved memory handling.

Bugzilla 308046 Commit 2693828e8d · 2026-02-18 Analysis

Credit: Nathaniel Oh (@calysteon), Arni Hardarson

CVE-2026-43713 CrossOrigin

Visiting a website may leak sensitive data

A permissions issue was addressed with additional restrictions.

Bugzilla 314806 Commit 73645abad2 · 2026-07-01 Analysis

Credit: Jody Ritonga

CVE-2026-43708 CrossOrigin

A malicious website may exfiltrate data cross-origin

The issue was addressed with improved input validation.

Bugzilla 315306 Commit 971435fdd3 · 2026-07-01 Analysis

Credit: Behzad Najjarpour Jabbari (@_G4ru_)

CVE-2026-43707

Processing maliciously crafted web content may lead to an unexpected process crash

A memory corruption issue was addressed with improved memory handling.

Bugzilla 315951 Fix not yet public

Credit: stratan (@5tratan) of Almamater Technologies, OpenAI Codex Security - Amy Burnett

CVE-2026-43705 TypeConfusion

Processing maliciously crafted web content may lead to memory corruption

A type confusion issue was addressed with improved checks.

Bugzilla 314528 Commit 8fd92b1021 · 2026-06-30 Analysis

Credit: dr3dd

CVE-2026-43701 LogicError

A malicious website may be able to process restricted web content outside the sandbox

The issue was addressed with improved checks.

Bugzilla 315004 Commit f23ffb5a84 · 2026-07-02 Analysis

Credit: Aaron Grattafiori - NVIDIA AI Red Team

CVE-2026-43745 LogicError

Processing maliciously crafted web content may lead to an unexpected Safari crash

An out-of-bounds write issue was addressed with improved input validation.

Bugzilla 315365 Commit 0f0de8f2a0 · 2026-07-01 Analysis

Credit: OpenAI Codex Security - Amy Burnett, Khai Tran

Safari 26.5 May 13, 2026 · 11 WebKit CVEs ·9 covered ↗

CVE-2026-43660 CrossOrigin

Processing maliciously crafted web content may prevent Content Security Policy from being enforced

A validation issue was addressed with improved logic.

Bugzilla 308906 Commit f8ed382fb2 · 2026-06-11 Analysis

Credit: Cantina

CVE-2026-28907 CrossOrigin

Processing maliciously crafted web content may prevent Content Security Policy from being enforced

The issue was addressed with improved input validation.

Bugzilla 308675 Commit 9a19d07c4f · 2026-05-21 Analysis

Credit: Cantina

CVE-2026-28962 SandboxEscape

Processing maliciously crafted web content may disclose sensitive user information

This issue was addressed with improved access restrictions.

Bugzilla 309698 Commit c6cd4e07e9 · 2026-06-16 Analysis

Credit: Luke Francis, Vaagn Vardanian, kwak kiyong / kakaogames, Vitaly Simonovich, Adel Bouachraoui, greenbynox

CVE-2026-43658 UAF

Processing maliciously crafted web content may lead to an unexpected Safari crash

The issue was addressed with improved memory handling.

Bugzilla 307669 Commit 9a16de46f2 · 2026-06-16 Analysis

Credit: Do Young Park

CVE-2026-28905 MemoryCorruption

Processing maliciously crafted web content may lead to an unexpected process crash

The issue was addressed with improved memory handling.

Bugzilla 308545 Commit 392f508eef · 2026-06-11 Analysis

Credit: Yuhao Hu, Yuanming Lai, Chenggang Wu, and Zhe Wang

CVE-2026-28883

Processing maliciously crafted web content may lead to an unexpected process crash

A use-after-free issue was addressed with improved memory management.

Bugzilla 313939 Fix not yet public

Credit: kwak kiyong / kakaogames

CVE-2026-28958 CrossOrigin

An app may be able to access sensitive user data

This issue was addressed with improved data protection.

Bugzilla 311228 Commit 093f34607a · 2026-06-02 Analysis

Credit: Cantina

CVE-2026-28917

Processing maliciously crafted web content may lead to an unexpected process crash

The issue was addressed with improved input validation.

Bugzilla 310527 Fix not yet public

Credit: Vitaly Simonovich

CVE-2026-28947 UAF

Processing maliciously crafted web content may lead to an unexpected Safari crash

A use-after-free issue was addressed with improved memory management.

Bugzilla 310234 Commit 76b3468621 · 2026-05-29 Analysis

Credit: dr3dd

CVE-2026-28971 LogicError

A malicious iframe may use another website’s download settings

The issue was addressed with improved UI handling.

Bugzilla 311288 Commit 4b574bf828 · 2026-06-05 Analysis

Credit: Khiem Tran

CVE-2026-43670 CrossOrigin

Processing maliciously crafted web content may bypass Content Security Policy

A Content Security Policy bypass was addressed with improved enforcement in AudioWorklet contexts.

Bugzilla 309004 Commit 933debd495 · 2026-06-14 Analysis

Credit: lebr0nli of National Yang Ming Chiao Tung University, Security and Systems Lab