CVE-2026-86897
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
This issue was addressed with additional entitlement checks. This issue is fixed in Safari 27, iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to access sensitive user data.
Risk Assessment
Unauthorized access to sensitive user data can lead to privacy violations and information leakage. The risk affects devices running unpatched Apple OS versions.
Recommendation
Update Safari and iOS, iPadOS, macOS, and visionOS to the patched versions. Review app permissions and restrict unnecessary entitlements.
Other vulnerabilities in Safari
See all- CVE-2017-2389High
An issue was discovered in certain Apple products affecting iOS before 10.3 and Safari before 10.1. The issue involves the 'Safari' component and allows remote attackers to spoof an HTTP authentication sheet or cause a denial of service via a crafted web site.
- CVE-2017-2376High
An issue was discovered in certain Apple products, including iOS before 10.3 and Safari before 10.1, related to the 'Safari' component. It allows remote attackers to spoof the address bar by leveraging text input during the loading of a page.
- CVE-2023-28205HighActively exploited
A use after free issue in Safari and Apple systems was addressed with improved memory management. The issue is fixed in Safari 16.4.1, iOS 15.7.5 and iPadOS 15.7.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1. Processing maliciously crafted web content may lead to arbitrary code execution, and Apple is aware of a report that this issue may have been actively exploited.
- CVE-2026-86898Medium
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening a maliciously crafted webarchive file may lead to universal cross-site scripting.
- CVE-2026-84518Medium
This issue was addressed through improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious website may be able to determine what apps a user has installed.
- CVE-2026-65351Medium
A vulnerability in the WebKit component of Safari was addressed through improved state management. Processing maliciously crafted web content may lead to an unexpected Safari crash.
- CVE-2026-65340Medium
The issue was addressed through improved state management. It is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, and visionOS 27. Processing maliciously crafted web content may lead to an unexpected Safari crash.
- CVE-2026-65338Medium
The issue was addressed with improved memory handling. It is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, and visionOS 27. Processing maliciously crafted web content may lead to an unexpected Safari crash.
- CVE-2026-65337Medium
The issue was addressed through improved state management. It is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, and visionOS 27. Processing maliciously crafted web content may lead to an unexpected Safari crash.
- CVE-2026-65336Medium
The issue was addressed through improved state management. It is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, and visionOS 27. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Original NVD description (English source)
This issue was addressed with additional entitlement checks. This issue is fixed in Safari 27, iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to access sensitive user data.