CVE-2026-64728
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Permissions validation was improved. The issue affects Safari 26.6, iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. Maliciously crafted web content may violate iframe sandboxing policy.
Risk Assessment
Risk of iframe sandbox bypass, potentially leading to XSS or data theft.
Recommendation
Update Safari to version 26.6 and systems to the appropriate versions.
Other vulnerabilities in Apple Safari/iOS/iPadOS/macOS/tvOS/visionOS/watchOS
See all- CVE-2026-64730Medium
UI was improved. The issue affects Safari 26.6, iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. Visiting a website that frames malicious content may lead to UI spoofing.
- CVE-2026-64713High
The issue was addressed with improved checks. The fix is included in Safari 26.6, iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. Websites may know if the user has visited a given link.
Original NVD description (English source)
A permissions issue was addressed with improved validation. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Maliciously crafted web content may violate iframe sandboxing policy.