Apple WebKit CVE-2026-112626

Exploitation requires the victim to process maliciously crafted web content in Safari/WebKit - in practice, opening or being redirected to an attacker-controlled web page (UI:R). No authentication or prior privileges on the target device are needed (PR:N), and it works against default configurations since WebKit is the system web engine on affected Apple platforms. The principal limiting factor is the required user interaction (the attacker cannot trigger it without the user loading the content); there is no non-default configuration or special feature toggle needed. Affected and unpatched builds only: the issue is fixed in Safari 27.2, iOS/iPadOS 26.7.2, iOS/iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, and watchOS 27.2 - updating to these versions is the vendor's remedy.

This is a WebKit use-after-free (CWE-416) reachable from the network with low attack complexity and no authentication (AV:N/AC:L/PR:N), but it requires user interaction (UI:R) - the victim must process maliciously crafted web content, i.e. visit an attacker-controlled page - which is the primary brake on mass exploitation. The CVSS base score of 8.8 and the SSVC Technical Impact of 'total' reflect that successful exploitation yields arbitrary code execution with high confidentiality, integrity, and availability impact. However, the exploitation-side signals are comparatively cool: SSVC Exploitation is 'none' (no observed or public exploitation), the vulnerability is not CISA KEV-listed, Automatable is 'no' (consistent with the UI:R requirement), and the EPSS score is only 0.57% (47th percentile), indicating no evidence of near-term widespread exploitation. The signals are therefore internally consistent rather than conflicting: high technical severity paired with low current exploitation likelihood. The vuln.today priority of 'this_week' aligns with a patch-promptly posture rather than an emergency. Net: a genuinely serious browser-engine RCE given WebKit's enormous footprint, but at time of analysis it is a prioritized-patch item, not an actively-exploited emergency. Note the common caveat for WebKit memory-corruption bugs: such flaws are frequently chained in real exploit chains, so the low EPSS should not be read as low intrinsic danger.

An attacker hosts a malicious web page and lures an Apple-device user into visiting it (via phishing, a malicious ad, or a compromised site); when Safari/WebKit processes the crafted web content it triggers the use-after-free, allowing the attacker to corrupt memory and execute arbitrary code in the browser context. No authentication is required but the victim must actively load the content (UI:R). No public exploit code or PoC reference was provided in the input.