Apple Safari 27: Exfiltration of installed apps via state management
CVE-2026-84518 Published on September 14, 2026
This issue was addressed through improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious website may be able to determine what apps a user has installed.
Vulnerability Analysis
CVE-2026-84518 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.
Weakness Type
External Control of Critical State Data
The software stores security-critical state information about its users, or the software itself, in a location that is accessible to unauthorized actors.
Products Associated with CVE-2026-84518
Want to know whenever a new CVE is published for Apple products? stack.watch will email you.
Affected Versions
Apple Safari:- Before 27 is affected.
- Before 27 is affected.
- Before 27 is affected.