Apple Safari
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Apple Safari.
Recent Apple Safari Security Advisories
| Advisory | Title | Published |
|---|---|---|
| 148286 | Safari 26.6.1 - Apple Security Content | August 18, 2026 |
| 128073 | Safari 26.6 - Apple Security Content | July 27, 2026 |
| 127685 | Safari 26.5.2 - Apple Security Content | June 29, 2026 |
| 127121 | Safari 26.5 - Apple Security Content | May 13, 2026 |
| 126800 | Safari 26.4 - Apple Security Content | March 24, 2026 |
| 126354 | Safari 26.3 - Apple Security Content | February 11, 2026 |
| 125892 | Safari 26.2 - Apple Security Content | December 12, 2025 |
| 125640 | Safari 26.1 - Apple Security Content | November 3, 2025 |
| 125113 | Safari 26 - Apple Security Content | September 15, 2025 |
| 124152 | Safari 18.6 - Apple Security Content | July 30, 2025 |
Known Exploited Apple Safari Vulnerabilities
The following Apple Safari vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.
| Title | Description | Added |
|---|---|---|
| Apple Safari Webkit Browser Engine Buffer Overflow Vulnerability |
Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. CVE-2021-30665 Exploit Probability: 3.7% |
November 3, 2021 |
| Apple Safari Webkit Browser Engine Integer Overflow Vulnerability |
Integer overflow. Processing maliciously crafted web content may lead to arbitrary code execution. CVE-2021-30663 Exploit Probability: 3.5% |
November 3, 2021 |
By the Year
In 2026 there have been 102 vulnerabilities in Apple Safari with an average score of 6.6 out of ten. Last year, in 2025 Safari had 102 security vulnerabilities published. If vulnerabilities keep coming in at the current rate, it appears that number of security vulnerabilities in Safari in 2026 could surpass last years number. Last year, the average CVE base score was greater by 0.18
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 102 | 6.60 |
| 2025 | 102 | 6.78 |
| 2024 | 61 | 6.70 |
| 2023 | 44 | 7.92 |
| 2022 | 42 | 7.84 |
| 2021 | 35 | 7.75 |
| 2020 | 74 | 7.15 |
| 2019 | 166 | 8.02 |
| 2018 | 41 | 8.11 |
It may take a day or so for new Safari vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Apple Safari Security Vulnerabilities
Safari Crash from Malicious Web Content: iOS/iPadOS 18.7.10, 26.6.1; macOS Tahoe 26.6.2
CVE-2026-65331
4.3 - Medium
- August 17, 2026
This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Improper Check or Handling of Exceptional Conditions
Apple iOS memory corruption fixed 18.7.10
CVE-2026-43794
8.8 - High
- August 17, 2026
A memory corruption issue was addressed with improved memory handling. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to memory corruption.
Buffer Overflow
Safari StateManagement Flaw Causing Unexpected Crash Before iOS 26.6.1
CVE-2026-65351
4.3 - Medium
- August 17, 2026
This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Improper Check or Handling of Exceptional Conditions
Safari memory corruption CVE-2026-64782 fixed in iOS 18.7.10
CVE-2026-64782
3.1 - Low
- August 17, 2026
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Race Condition
Apple Safari Crash via Malformed Web Content (Fixed v 18.7.10/26.6.2)
CVE-2026-43795
4.3 - Medium
- August 17, 2026
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Buffer Overflow
Safari Crash via Malicious Web Content (Fixed in iOS 18.7.10 & macOS 26.6.2)
CVE-2026-65340
4.3 - Medium
- August 17, 2026
This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Improper Input Validation
Safari Crash via Malicious Web Content iOS 18.7.10
CVE-2026-65337
4.3 - Medium
- August 17, 2026
This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Improper Input Validation
Apple Safari crash via malformed web content (before 26.6.2)
CVE-2026-65336
4.3 - Medium
- August 17, 2026
This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Improper Input Validation
Apple Safari OOB Buffer Crash before iOS 18.7.10 / macOS 26.6.2
CVE-2026-64784
4.3 - Medium
- August 17, 2026
An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Out-of-bounds Read
Apple iOS Mem Corruption via Malicious Web Content (Fixed in iOS 18.7.10)
CVE-2026-65341
5.4 - Medium
- August 17, 2026
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to memory corruption.
Buffer Overflow
Use-after-Free in Apple WK Causing Crash iOS 26.6.1/iPadOS 26.6.1 macOS 26.6.2
CVE-2026-64787
6.5 - Medium
- August 17, 2026
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6.1, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected process termination.
Dangling pointer
Safari Web Crash via Malicious Content (Fixed in iOS 18.7.10, macOS 26.6.2)
CVE-2026-65335
4.3 - Medium
- August 17, 2026
This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Buffer Overflow
Apple Safari memory corruption on iOS <18.7.10 (crash via malicious web)
CVE-2026-65334
4.3 - Medium
- August 17, 2026
A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Buffer Overflow
Safari WebKit crash via memory bug, fixed iOS 18.7.10
CVE-2026-65338
4.3 - Medium
- August 17, 2026
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Buffer Overflow
Apple Safari Crash via Malicious Web Content (before 18.7.10)
CVE-2026-65333
4.3 - Medium
- August 17, 2026
This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Buffer Overflow
Apple iOS/iPadOS/macOS Data Leak via Malicious Site Before 18.7.10/26.6.1
CVE-2026-64778
6.5 - Medium
- August 17, 2026
The issue was addressed with improved checks. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Visiting a maliciously crafted website may leak sensitive data.
Information Disclosure
Apple Safari Crash via Malicious Web Content (pre iOS 18.7.10)
CVE-2026-64781
4.3 - Medium
- August 17, 2026
The issue was addressed with improved input validation. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Improper Input Validation
Apple OS UseAfterFree in WebKit Fixed iOS 18.7.10, macOS 26.6.2
CVE-2026-64715
6.5 - Medium
- August 17, 2026
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected process crash.
Dangling pointer
Safari iOS/iPadOS/macOS Crash from Malicious Web Content Fixed in 26.6.1
CVE-2026-64780
4.3 - Medium
- August 17, 2026
The issue was addressed with improved checks. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Buffer Overflow
Apple Safari CVE-2026-64779 fixed in iOS 18.7.10 & macOS 26.6.2
CVE-2026-64779
3.1 - Low
- August 17, 2026
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Race Condition
Apple Safari Crash via Malicious Web Fixed iOS 18.7.10/PadOS 18.7.10/iOS26.6.1
CVE-2026-65332
4.3 - Medium
- August 17, 2026
This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Improper Check or Handling of Exceptional Conditions
SAFARI USE-AFTER-FREE CRASH VULN FIXED IN 26.6
CVE-2026-64783
8.8 - High
- July 27, 2026
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Dangling pointer
Safari Memory Corruption Fixed in 26.6 (iOS, macOS, watchOS, visionOS)
CVE-2026-64757
8.8 - High
- July 27, 2026
A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 26.6, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Buffer Overflow
Safari DoS via State Mgmt in 26.5+
CVE-2026-43804
6.5 - Medium
- July 27, 2026
This issue was addressed through improved state management. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6. Visiting a website may lead to an app denial-of-service.
Resource Exhaustion
Safari Authorization Flaw Pre-26.6 Allows App Access to Sensitive Data
CVE-2026-43792
6.5 - Medium
- July 27, 2026
An authorization issue was addressed with improved state management. This issue is fixed in Safari 26.6, macOS Tahoe 26.6. An app may be able to access sensitive user data.
AuthZ
Apple Safari UI Spoofing via Frame Content (fixed in 26.6)
CVE-2026-64730
6.5 - Medium
- July 27, 2026
The issue was addressed with improved UI. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Visiting a website that frames malicious content may lead to UI spoofing.
User Interface (UI) Misrepresentation of Critical Information
Safari 26.6 Improved Access Restrictions Mandate Strict Sandbox Isolation
CVE-2026-43821
6.5 - Medium
- July 27, 2026
An access issue was addressed with improved access restrictions. This issue is fixed in Safari 26.6, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to read files outside of its sandbox.
Authorization
Apple Safari 26.6: Visited Link Exposure via Referral Check
CVE-2026-64713
8.1 - High
- July 27, 2026
This issue was addressed with improved checks. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Websites may know if the user has visited a given link.
Side Channel Attack
Safari 26.6: iframe sandbox validation flaw
CVE-2026-64728
6.5 - Medium
- July 27, 2026
A permissions issue was addressed with improved validation. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Maliciously crafted web content may violate iframe sandboxing policy.
Protection Mechanism Failure
Out-of-bounds Access in Safari v26.6 Fixed
CVE-2026-64719
8.1 - High
- July 27, 2026
An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 26.6, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Out-of-bounds Read
Use-After-Free in Safari 26.6 - Unexpected Crash
CVE-2026-64718
5.5 - Medium
- July 27, 2026
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Dangling pointer
Apple Safari 26.5.1 Cross-Origin Info Leak
CVE-2026-43700
6.5 - Medium
- June 29, 2026
A cross-origin issue was addressed with improved tracking of security origins. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may disclose sensitive user information.
Origin Validation Error
Safari 26.5.2 Crash via Malicious Web Content, Fixed
CVE-2026-43716
6.5 - Medium
- June 29, 2026
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Dangling pointer
Safari use-after-free CVE-2026-43720 fixed in Safari 26.5.2
CVE-2026-43720
6.5 - Medium
- June 29, 2026
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Dangling pointer
Apple Safari 26.5.2: Memory Handling Crash with Malicious Web Content
CVE-2026-39872
6.5 - Medium
- June 29, 2026
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected process crash.
Dangling pointer
Clipboard Hijack in Safari 26.5.2 (iOS/macOS)
CVE-2026-43721
6.5 - Medium
- June 29, 2026
This issue was addressed through improved state management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. A malicious website may be able to silently hijack clipboard data.
Incorrect Permission Assignment for Critical Resource
Apple Safari 26.5.2 UAF Crash via Malformed Web Content
CVE-2026-43717
6.5 - Medium
- June 29, 2026
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Dangling pointer
Apple Safari 26.5.2 Memory Disclosure via Malicious Web Content
CVE-2026-43740
6.5 - Medium
- June 29, 2026
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may result in the disclosure of process memory.
Dangling pointer
Apple Safari/iOS Sandbox Bypass via Malicious Site (fixed in 26.5.2)
CVE-2026-43701
7.1 - High
- June 29, 2026
The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. A malicious website may be able to process restricted web content outside the sandbox.
Authorization
Safari Mem Corruption Crash <26.5.2
CVE-2026-43663
6.5 - Medium
- June 29, 2026
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected process crash.
Dangling pointer
Use-After-Free in Safari 26.5.2 Causing Crash
CVE-2026-43726
6.5 - Medium
- June 29, 2026
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected process crash.
Dangling pointer
Apple Safari 26.5.2 Use-After-Free Crash
CVE-2026-43746
6.5 - Medium
- June 29, 2026
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Dangling pointer
Safari 26.5.2 Memory Corruption Fix: Crash from Malicious Web Content
CVE-2026-43707
6.5 - Medium
- June 29, 2026
A memory corruption issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected process crash.
Buffer Overflow
Use-After-Free Crash in Safari, iOS/iPadOS/macOS, Fixed in 26.5.2
CVE-2026-43727
6.5 - Medium
- June 29, 2026
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Dangling pointer
Apple Safari <26.5.2: UAF in Web Content (fixed v26.5.2)
CVE-2026-43731
8.8 - High
- June 29, 2026
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to memory corruption.
Dangling pointer
Safari Path Handling Disclosure Vulnerability Fixed 26.5.2
CVE-2026-43732
6.5 - Medium
- June 29, 2026
A path handling issue was addressed with improved validation. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may disclose sensitive user information.
Directory traversal
CVE-2026-43708 Safari <26.5.2 cross-origin data exfiltration
CVE-2026-43708
4.3 - Medium
- June 29, 2026
The issue was addressed with improved input validation. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. A malicious website may exfiltrate data cross-origin.
Improper Input Validation
Apple Safari Crash via Malicious Web Content, Fixed in 26.5.2
CVE-2026-43712
6.5 - Medium
- June 29, 2026
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected process crash.
Memory Corruption
Out-of-Bounds Write Leading to Safari Crash (pre-26.5.2)
CVE-2026-43745
6.5 - Medium
- June 29, 2026
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Memory Corruption
Apple Safari 26.5.2 Use-After-Free in Web Extension Causing Crash
CVE-2026-43704
5.3 - Medium
- June 29, 2026
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. A malicious web extension may be able to cause an unexpected process crash.
Dangling pointer
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Apple Safari or by Apple? Click the Watch button to subscribe.
