Websites may know if the user has visited a given link
This issue was addressed with improved checks.
Credit: Kwak Kiyong, Song Nuri
Apple Security Updates
WebKit CVEs from Apple's Safari security release pages, cross-referenced to the public WebKit fix commit and, when covered, to the WebKit Weekly analysis of that fix.
Matching is by WebKit Bugzilla number — Apple exposes it on every WebKit CVE
entry, and WebKit commits include the same ID as a
bugs.webkit.org/show_bug.cgi?id=… reference. Unmatched CVEs are
shown too: they usually mean the fix commit is still under Bugzilla embargo.
20 Safari releases
130 WebKit CVEs
102 matched to a commit
13 covered in a report
15 mentioned in a report
Safari 26.6 ↗
Visiting a website that frames malicious content may lead to UI spoofing
The issue was addressed with improved UI.
Credit: Kagami Rosylight of Mozilla
Maliciously crafted web content may violate iframe sandboxing policy
A permissions issue was addressed with improved validation.
Credit: an anonymous researcher
Processing maliciously crafted web content may lead to an unexpected Safari crash
A use-after-free issue was addressed with improved memory management.
Credit: 杉山 壮太, lattice, Behzad Najjarpour Jabbari (@_G4ru_), Junyeong Lee, Mooth.ai, OGINOME Tomohito, Using GLM From Z.AI, Gia Bui (@yabeow) from Calif.io
Processing maliciously crafted web content may lead to an unexpected Safari crash
A memory corruption issue was addressed with improved state management.
Credit: Milad Nasr and Nicholas Carlini with Claude, Anthropic
Visiting a website may lead to an app denial-of-service
This issue was addressed through improved state management.
Credit: Heiko Kiesel of SEEMOO, TU Darmstadt
An app may be able to read files outside of its sandbox
An access issue was addressed with improved access restrictions.
Credit: Brian Carpenter
Safari 26.5.2 ↗
Processing maliciously crafted web content may disclose sensitive user information
A cross-origin issue was addressed with improved tracking of security origins.
Credit: Vitaly Simonovich, Christian Meurer Xavier
A malicious website may exfiltrate data cross-origin
The issue was addressed with improved checks.
Credit: Gurpreet Shergill, Merrick Hare, Drinor Selmanaj (Sentry), Khai Tran, John Lussier, Rhyru9, Kwak Kiyong, Song Nuri
Processing maliciously crafted web content may lead to an unexpected process crash
A use-after-free issue was addressed with improved memory management.
Credit: Jonathan Alush-Aben
Processing maliciously crafted web content may disclose sensitive user information
A path handling issue was addressed with improved validation.
Credit: Nan Wang (@eternalsakura13)
Processing maliciously crafted web content may lead to memory corruption
A use-after-free issue was addressed with improved memory management.
Credit: dr3dd
Processing maliciously crafted web content may lead to an unexpected Safari crash
A use-after-free issue was addressed with improved memory management.
Credit: Tommy DeVoss from Braze Security Team (@thedawgyg), Gia Bui (@yabeow) from Calif.io, Gurpreet Shergill
A malicious website may be able to process restricted web content outside the sandbox
The issue was addressed with improved input validation.
Credit: Luke Francis
Processing maliciously crafted web content may lead to an unexpected process crash
The issue was addressed with improved memory handling.
Credit: stratan (@5tratan) of Almamater Technologies, Soyeon Park, Amy Burnett, Khai Tran, sherkito, Kota Toda, HexRabbit (@h3xr4bb1t) and NiNi (@terrynini38514) of DEVCORE Research Team, Using GLM From Z.AI, Tristan Madani (@TristanInSec) from Talence Security, Brian Carpenter
Processing maliciously crafted web content may lead to an unexpected Safari crash
The issue was addressed with improved memory handling.
Credit: Maher Azzouzi, Tuan and Duc from Calif.io, OpenAI Codex Security - Amy Burnett, Evan Lambert
Processing maliciously crafted web content may lead to an unexpected Safari crash
An out-of-bounds access issue was addressed with improved bounds checking.
Credit: Mateusz Krzywicki (iVerify.io), dr3dd, Tommy DeVoss from Braze Security Team (@thedawgyg)
Processing maliciously crafted web content may result in the disclosure of process memory
The issue was addressed with improved memory handling.
Credit: Nathaniel Oh (@calysteon), Arni Hardarson
Visiting a website may leak sensitive data
A permissions issue was addressed with additional restrictions.
Credit: Jody Ritonga
A malicious website may exfiltrate data cross-origin
The issue was addressed with improved input validation.
Credit: Behzad Najjarpour Jabbari (@_G4ru_)
Processing maliciously crafted web content may lead to an unexpected process crash
A memory corruption issue was addressed with improved memory handling.
Credit: stratan (@5tratan) of Almamater Technologies, OpenAI Codex Security - Amy Burnett
Processing maliciously crafted web content may lead to memory corruption
A type confusion issue was addressed with improved checks.
Credit: dr3dd
A malicious website may be able to process restricted web content outside the sandbox
The issue was addressed with improved checks.
Credit: Aaron Grattafiori - NVIDIA AI Red Team
Processing maliciously crafted web content may lead to an unexpected Safari crash
An out-of-bounds write issue was addressed with improved input validation.
Credit: OpenAI Codex Security - Amy Burnett, Khai Tran
Safari 26.5 ↗
Processing maliciously crafted web content may prevent Content Security Policy from being enforced
A validation issue was addressed with improved logic.
Credit: Cantina
Processing maliciously crafted web content may prevent Content Security Policy from being enforced
The issue was addressed with improved input validation.
Credit: Cantina
Processing maliciously crafted web content may disclose sensitive user information
This issue was addressed with improved access restrictions.
Credit: Luke Francis, Vaagn Vardanian, kwak kiyong / kakaogames, Vitaly Simonovich, Adel Bouachraoui, greenbynox
Processing maliciously crafted web content may lead to an unexpected Safari crash
The issue was addressed with improved memory handling.
Credit: Do Young Park
Processing maliciously crafted web content may lead to an unexpected process crash
The issue was addressed with improved memory handling.
Credit: Yuhao Hu, Yuanming Lai, Chenggang Wu, and Zhe Wang
Processing maliciously crafted web content may lead to an unexpected process crash
A use-after-free issue was addressed with improved memory management.
Credit: kwak kiyong / kakaogames
An app may be able to access sensitive user data
This issue was addressed with improved data protection.
Credit: Cantina
Processing maliciously crafted web content may lead to an unexpected process crash
The issue was addressed with improved input validation.
Credit: Vitaly Simonovich
Processing maliciously crafted web content may lead to an unexpected Safari crash
A use-after-free issue was addressed with improved memory management.
Credit: dr3dd
A malicious iframe may use another website’s download settings
The issue was addressed with improved UI handling.
Credit: Khiem Tran
Safari 26.4 ↗
Processing maliciously crafted web content may prevent Content Security Policy from being enforced
This issue was addressed through improved state management.
Credit: webb
Processing maliciously crafted web content may bypass Same Origin Policy
A cross-origin issue in the Navigation API was addressed with improved input validation.
Credit: Thomas Espach
Visiting a maliciously crafted website may lead to a cross-site scripting attack
A logic issue was addressed with improved checks.
Credit: @hamayanhamayan
Processing maliciously crafted web content may lead to an unexpected process crash
The issue was addressed with improved memory handling.
Credit: Yeonghyeon Choi, Daniel Rhea, Söhnke Benedikt Fischedick (Tripton), Emrovsky & Switch3301, Yevhen Pervushyn
A malicious website may be able to access script message handlers intended for other origins
A logic issue was addressed with improved state management.
Credit: Hongze Wu and Shuaike Dong from Ant Group Infrastructure Security Team, and webb
A malicious website may be able to process restricted web content outside the sandbox
The issue was addressed with improved memory handling.
Credit: greenbynox, Arni Hardarson, and an anonymous researcher
Safari 26.3 ↗
A remote attacker may be able to cause a denial-of-service
The issue was addressed with improved memory handling.
Credit: Nathaniel Oh (@calysteon)
Processing maliciously crafted web content may lead to an unexpected process crash
This issue was addressed through improved state management.
Credit: HanQing from TSDubhe and Nan Wang (@eternalsakura13)
A website may be able to track users through Safari web extensions
This issue was addressed through improved state management.
Credit: Tom Van Goethem
Processing maliciously crafted web content may lead to an unexpected process crash
The issue was addressed with improved memory handling.
Credit: HanQing from TSDubhe and Nan Wang (@eternalsakura13)
Safari 26.2 ↗
An app may be able to access sensitive user data
The issue was addressed with additional permissions checks.
Credit: Wojciech Regula of SecuRing (wojciechregula.blog)
Processing maliciously crafted web content may lead to an unexpected Safari crash
A type confusion issue was addressed with improved state handling.
Credit: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative
Processing maliciously crafted web content may lead to an unexpected process crash
A use-after-free issue was addressed with improved memory management.
Credit: Nan Wang (@eternalsakura13)
Processing maliciously crafted web content may lead to an unexpected process crash
The issue was addressed with improved memory handling.
Credit: Google Big Sleep, Nan Wang (@eternalsakura13)
Processing maliciously crafted web content may lead to an unexpected process crash
A buffer overflow issue was addressed with improved memory handling.
Credit: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative
Processing maliciously crafted web content may lead to an unexpected process crash
A race condition was addressed with improved state handling.
Credit: Phil Pizlo of Epic Games
Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report.
A use-after-free issue was addressed with improved memory management.
Credit: Google Threat Analysis Group
Processing maliciously crafted web content may lead to memory corruption. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-43529 was also issued in response to this report.
A memory corruption issue was addressed with improved validation.
Credit: Apple and Google Threat Analysis Group
Processing maliciously crafted web content may disclose internal states of the app
A memory initialization issue was addressed with improved memory handling.
Credit: Google Big Sleep
Safari 26.1 ↗
A malicious website may exfiltrate data cross-origin
The issue was addressed with improved checks.
Credit: Aleksejs Popovs
Processing maliciously crafted web content may lead to an unexpected process crash
This issue was addressed through improved state management.
Credit: Phil Beauvoir
Processing maliciously crafted web content may lead to an unexpected process crash
This issue was addressed with improved checks.
Credit: an anonymous researcher
Processing maliciously crafted web content may lead to an unexpected process crash
The issue was addressed with improved memory handling.
Credit: rheza (@ginggilBesel)
Processing maliciously crafted web content may lead to an unexpected process crash
This issue was addressed with improved checks
Credit: Nan Wang (@eternalsakura13)
Processing maliciously crafted web content may lead to an unexpected Safari crash
A use-after-free issue was addressed with improved memory management.
Credit: rheza (@ginggilBesel), shandikri working with Trend Micro Zero Day Initiative
Processing maliciously crafted web content may lead to memory corruption
The issue was addressed with improved memory handling.
Credit: Google Big Sleep
Processing maliciously crafted web content may lead to an unexpected process crash
A use-after-free issue was addressed with improved memory management.
Credit: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative
Processing maliciously crafted web content may lead to an unexpected process crash
A buffer overflow was addressed with improved bounds checking.
Credit: Google Big Sleep
Processing maliciously crafted web content may lead to an unexpected process crash
Multiple issues were addressed by disabling array allocation sinking.
Credit: Nan Wang (@eternalsakura13)
Safari 26 ↗
A website may be able to access sensor information without user consent
The issue was addressed with improved handling of caches.
Credit: Jaydev Ahire
Processing maliciously crafted web content may lead to an unexpected Safari crash
The issue was addressed with improved memory handling.
Credit: Big Bear
Processing maliciously crafted web content may lead to an unexpected process crash
The issue was addressed with improved memory handling.
Credit: an anonymous researcher
Processing maliciously crafted web content may lead to an unexpected process crash
A correctness issue was addressed with improved checks.
Credit: an anonymous researcher
Processing maliciously crafted web content may lead to memory corruption
The issue was addressed with improved memory handling.
Credit: Ignacio Sanmillan (@ulexec)
A remote attacker may be able to view leaked DNS queries with Private Relay turned on
A logic issue was addressed with improved state management.
Credit: Mike Cardwell of grepular.com, Bob Lord
Safari 18.6 ↗
Processing maliciously crafted web content may lead to universal cross site scripting
This issue was addressed through improved state management.
Credit: Martin Bajanik of Fingerprint, Ammar Askar
Visiting a malicious website may lead to address bar spoofing
The issue was addressed with improved UI.
Credit: Jaydev Ahire
Processing maliciously crafted web content may disclose sensitive user information
This issue was addressed through improved state management.
Credit: Gilad Moav, Yehuda Afek, Anat Bremler-Barr, and Amit Klein
Processing maliciously crafted web content may lead to memory corruption
The issue was addressed with improved memory handling.
Credit: Yuhao Hu, Yan Kang, Chenggang Wu, and Xiaojie Wei
A download's origin may be incorrectly associated
A logic issue was addressed with improved checks.
Credit: Syarif Muhammad Sajjad
Processing maliciously crafted web content may lead to an unexpected Safari crash
The issue was addressed with improved memory handling.
Credit: shandikri working with Trend Micro Zero Day Initiative, Google V8 Security Team
Processing web content may lead to a denial-of-service
The issue was addressed with improved memory handling.
Credit: Yuhao Hu, Yan Kang, Chenggang Wu, and Xiaojie Wei
Processing maliciously crafted web content may disclose internal states of the app
An out-of-bounds read was addressed with improved input validation.
Credit: HexRabbit (@h3xr4bb1t) from DEVCORE Research Team
Processing maliciously crafted web content may lead to an unexpected Safari crash
A use-after-free issue was addressed with improved memory management.
Credit: Ignacio Sanmillan (@ulexec)
Processing maliciously crafted web content may lead to an unexpected Safari crash
This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at
Credit: Clément Lecigne and Vlad Stolyarov of Google's Threat Analysis Group
Safari 18.5 ↗
A type confusion issue could lead to memory corruption
This issue was addressed with improved handling of floats.
Credit: Google V8 Security Team
Processing maliciously crafted web content may lead to memory corruption
The issue was addressed with improved checks.
Credit: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs
Processing maliciously crafted web content may lead to memory corruption
The issue was addressed with improved memory handling.
Credit: rheza (@ginggilBesel), Edouard Bochin (@le_douds) and Tao Yan (@Ga1ois) of Palo Alto Networks
Processing maliciously crafted web content may lead to an unexpected Safari crash
The issue was addressed with improved input validation.
Credit: Ignacio Sanmillan (@ulexec)
Processing maliciously crafted web content may lead to an unexpected process crash
The issue was addressed with improved checks.
Credit: Jiming Wang and Jikai Ren
Processing maliciously crafted web content may lead to an unexpected Safari crash
A type confusion issue was addressed with improved state handling.
Credit: Yuhao Hu, Yan Kang, Chenggang Wu, Xiaojie Wei
A malicious website may exfiltrate data cross-origin
The issue was addressed with improved checks.
Credit: Ivan Fratric of Google Project Zero
Processing maliciously crafted web content may lead to an unexpected Safari crash
This issue was addressed with improved memory handling.
Credit: Juergen Schmied of Lynck GmbH
Safari 18.4 ↗
Processing maliciously crafted web content may lead to an unexpected Safari crash
The issue was addressed with improved memory handling.
Credit: Gary Kwong, and an anonymous researcher
Processing maliciously crafted web content may lead to an unexpected process crash
A buffer overflow issue was addressed with improved memory handling.
Credit: Francisco Alonso (@revskills), and an anonymous researcher
Loading a malicious iframe may lead to a cross-site scripting attack
A permissions issue was addressed with additional restrictions.
Credit: Muhammad Zaid Ghifari (Mr.ZheeV) and Kalimantan Utara
Processing maliciously crafted web content may lead to an unexpected Safari crash
A use-after-free issue was addressed with improved memory management.
Credit: rheza (@ginggilBesel)
A malicious website may be able to track users in Safari private browsing mode
This issue was addressed through improved state management.
Credit: an anonymous researcher
Safari 18.3.1 ↗
Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.)
An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions.
Credit: Apple
Safari 18.3 ↗
Processing maliciously crafted web content may lead to memory corruption
The issue was addressed with improved checks.
Credit: an anonymous researcher
A maliciously crafted webpage may be able to fingerprint the user
The issue was addressed with improved access restrictions to the file system.
Credit: an anonymous researcher
Processing web content may lead to a denial-of-service
The issue was addressed with improved memory handling.
Credit: Q1IQ (@q1iqF) of NUS CuriOSity and P1umer (@p1umer) of Imperial Global Singapore
Processing maliciously crafted web content may lead to an unexpected process crash
This issue was addressed through improved state management.
Credit: linjy of HKUS3Lab and chluo of WHUSecLab
Safari 18.2 ↗
Processing maliciously crafted web content may lead to an unexpected process crash
The issue was addressed with improved checks.
Credit: Seunghyun Lee
Processing maliciously crafted web content may lead to an unexpected process crash
The issue was addressed with improved memory handling.
Credit: linjy of HKUS3Lab and chluo of WHUSecLab, Xiangwei Zhang of Tencent Security YUNDING LAB
Processing maliciously crafted web content may lead to memory corruption
A type confusion issue was addressed with improved memory handling.
Credit: Gary Kwong
Processing maliciously crafted web content may lead to memory corruption
The issue was addressed with improved memory handling.
Credit: Tashita Software Security
Safari 18.1.1 ↗
Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.
A cookie management issue was addressed with improved state management.
Credit: Clément Lecigne and Benoît Sevens of Google's Threat Analysis Group
Safari 18.1 ↗
Cookies belonging to one origin may be sent to another origin
A cookie management issue was addressed with improved state management.
Credit: Wojciech Regula of SecuRing (
Processing maliciously crafted web content may prevent Content Security Policy from being enforced
The issue was addressed with improved checks.
Credit: Narendra Bhati, Manager of Cyber Security at Suma Soft Pvt. Ltd, Pune (India)
Processing maliciously crafted web content may lead to an unexpected process crash
A memory corruption issue was addressed with improved input validation.
Credit: an anonymous researcher, Q1IQ (@q1iqF) and P1umer (@p1umer)
Safari 18 ↗
A malicious website may exfiltrate data cross-origin
A cookie management issue was addressed with improved state management.
Credit: Narendra Bhati, Manager of Cyber Security At Suma Soft Pvt. Ltd, Pune (India)
Processing maliciously crafted web content may lead to an unexpected process crash
The issue was addressed with improved checks.
Credit: Tashita Software Security
Visiting a malicious website may lead to address bar spoofing
The issue was addressed with improved UI.
Credit: Hafiizh and YoKo Kho (@yokoacc) of HakTrak
A malicious website may exfiltrate data cross-origin
A cross-origin issue existed with "iframe" elements. This was addressed with improved tracking of security origins.
Credit: Narendra Bhati, Manager of Cyber Security at Suma Soft Pvt. Ltd, Pune (India)
Processing maliciously crafted web content may lead to universal cross site scripting
This issue was addressed through improved state management.
Credit: Ron Masas
Safari 17.6 ↗
Processing web content may lead to a denial-of-service
The issue was addressed with improved memory handling.
Credit: ajajfxhj
Processing maliciously crafted web content may lead to an unexpected process crash
A use-after-free issue was addressed with improved memory management.
Credit: Huang Xilin of Ant Group Light-Year Security Lab
Processing maliciously crafted web content may lead to an unexpected process crash
An out-of-bounds read was addressed with improved bounds checking.
Credit: Huang Xilin of Ant Group Light-Year Security Lab
Processing maliciously crafted web content may lead to a cross site scripting attack
This issue was addressed with improved checks.
Credit: Johan Carlsson (joaxcar)
Processing maliciously crafted web content may lead to an unexpected process crash
An out-of-bounds access issue was addressed with improved bounds checking.
Credit: Seunghyun Lee (@0x10n) of KAIST Hacking Lab working with Trend Micro Zero Day Initiative
Private Browsing tabs may be accessed without authentication
This issue was addressed through improved state management.
Credit: Matthew Butler
Processing maliciously crafted web content may lead to an unexpected process crash
The issue was addressed with improved checks.
Credit: Gary Kwong
A user may be able to bypass some web content restrictions
An issue in the handling of URL protocols was addressed with improved logic.
Credit: Andreas Jaegersberger and Ro Achterberg
Safari 17.5 ↗
Processing a file may lead to unexpected app termination or arbitrary code execution
The issue was addressed with improved checks.
Credit: Maksymilian Motyl of Immunity Systems, Junsung Lee working with Trend Micro Zero Day Initiative, and ajajfxhj
An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication
The issue was addressed with improved checks.
Credit: Manfred Paul (@_manfp) working with Trend Micro's Zero Day Initiative
A maliciously crafted webpage may be able to fingerprint the user
The issue was addressed by adding additional logic.
Credit: Emilio Cobos of Mozilla
Processing web content may lead to arbitrary code execution
The issue was addressed with improved memory handling.
Credit: Lukas Bernhard of CISPA Helmholtz Center for Information Security
A maliciously crafted webpage may be able to fingerprint the user
This issue was addressed with improvements to the noise injection algorithm.
Credit: an anonymous researcher
Processing maliciously crafted web content may lead to arbitrary code execution
An integer overflow was addressed with improved input validation.
Credit: Manfred Paul (@_manfp) working with Trend Micro Zero Day Initiative
Processing maliciously crafted web content may lead to arbitrary code execution
The issue was addressed with improved bounds checks.
Credit: Nan Wang (@eternalsakura13) of 360 Vulnerability Research Institute
Safari 17.4 ↗
Processing web content may lead to a denial-of-service
The issue was addressed with improved memory handling.
Credit: anbu1024 of SecANT
A malicious website may exfiltrate audio data cross-origin
The issue was addressed with improved UI handling.
Credit: James Lee (@Windowsrcer)
Processing maliciously crafted web content may prevent Content Security Policy from being enforced
A logic issue was addressed with improved validation.
Credit: Johan Carlsson (joaxcar)
A maliciously crafted webpage may be able to fingerprint the user
An injection issue was addressed with improved validation.
Credit: an anonymous researcher
Processing maliciously crafted web content may prevent Content Security Policy from being enforced
A logic issue was addressed with improved state management.
Credit: Georg Felber and Marco Squarcina