EUVD-2026-110172
GHSA-553x-65c8-v7v2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious web page
-
DeliveryDeliver crafted web content to WebKit
-
ExploitTrigger use-after-free in rendering
-
ExecutionCorrupt memory for code execution
-
ImpactExecute arbitrary code in browser context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to process attacker-controlled web content in Safari or a WebKit-based view - i.e., open or render a malicious page - so success depends on user interaction (UI:R); it is not a drive-by against a server with no user action. No authentication or special privileges are needed (PR:N), and default configurations are affected since the flaw is in core WebKit web-content processing. The practical limiting factor is the need to get a user of an unpatched Safari 27.2 / iOS·iPadOS 26.7.2 / iOS·iPadOS 27.2 / macOS Golden Gate 27.2 / visionOS 27.2 build to load the crafted content. The only complete fix stated by the vendor is updating to those versions. |
| Impact | Signals are moderately consistent and point to a serious-but-not-emergency issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated WebKit flaw whose only gating factor is user interaction (visiting or processing malicious web content). Against that, the exploitation signals are restrained: EPSS is only 0.54% (45th percentile), there is no CISA KEV listing, and CISA SSVC records Exploitation: none and Automatable: no, while rating Technical Impact: total. So the high base score reflects impact (arbitrary code execution) rather than demonstrated likelihood of mass exploitation. The vuln.today priority is 'this_week', consistent with a patch-available WebKit memory-corruption bug that merits prompt remediation but is not flagged as actively exploited. This is a genuine priority for any Apple-client fleet because the attack surface (web browsing) is enormous and the impact is total, but at the time of analysis there is no evidence of in-the-wild use; EPSS and SSVC both argue against widespread exploitation today. No signals are directly conflicting; the main tension is a high impact score paired with low current exploitation probability. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page (or injects crafted content into one a victim already trusts) and lures a user of Safari/WebKit on iOS, iPadOS, macOS, or visionOS to view it. Processing the crafted content triggers the use-after-free (CWE-416), corrupting memory to achieve arbitrary code execution in the browser's context. No public exploit identified at time of analysis; user interaction (loading the content) is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Arbitrary code execution in Apple's WebKit rendering engine affects Safari, iOS and iPadOS, macOS Golden Gate, and visionOS users who process maliciously crafted web content. The flaw is a use-after-free (CWE-416) that Apple addressed with improved memory management, and the vendor's only complete fix is updating to the listed releases. No active exploitation is confirmed (CISA SSVC exploitation: none) and no public exploit code is confirmed; EPSS is 0.54% (45th percentile), so this is a serious but not emergency-level patching priority - patch within this week.
RemediationAI
Vendor-released patch: Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, and visionOS 27.2. Apple states that updating to these versions is the fix, and per the assessment the only complete remediation is updating, so prioritize browser and OS updates on all affected device families, including iPhone, iPad, Mac, and Vision Pro hardware, since the defect is in core web-content processing and default configurations are affected. Track deployment through the Apple advisories at https://support.apple.com/en-us/149227, https://support.apple.com/en-us/149230, https://support.apple.com/en-us/149521, https://support.apple.com/en-us/149526 and https://support.apple.com/en-us/149527; no additional compensating controls beyond the vendor's update guidance are confirmed in the available sources. Exploitation requires a user to open or render crafted web content, so unpatched devices remain exposed until the update is installed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-416 use-after-free: memory is released while a reference to it remains, allowing later access to freed memory that can be reallocated with attacker-influenced contents; in a browser engine this class of defect typically leads to memory corruption and, with careful heap layout control, code execution in the renderer. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates the attack surface is network-delivered web content, no privileges or authentication are required, and the limiting prerequisite is user interaction (the victim must load or render the attacker's content). Apple's advisory language attributes the root cause to memory management and states the fix is improved memory management; the specific trigger within WebKit is not described in the available sources. CPE data covers Safari, iOS and iPadOS, macOS, and visionOS, consistent with a shared WebKit core, so default configurations of all listed platforms are exposed wherever web content is rendered.
Know when Visionos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote malicious web content needs no privileges (PR:N) but requires the victim to load it (UI:R); WebKit code execution yields high C/I/A with no scope change.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.
Executive ViewAI
A high-severity memory corruption vulnerability in Apple's WebKit engine, used by Safari, iOS, iPadOS, macOS, and visionOS, could allow arbitrary code execution when users view malicious web content. While no active exploitation or public exploit code is currently confirmed, the broad install base across Apple devices means a future exploit could affect a large portion of the workforce and consumer base.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
A critical out-of-bounds write in WebKit's rendering engine allows maliciously crafted web content to escape the Web Con
Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
Arbitrary code execution in Apple Safari, iOS/iPadOS, macOS Sequoia, and visionOS occurs when processing maliciously cra
Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such
Remote code execution in Google Chrome's ANGLE graphics layer allows attackers to compromise systems via crafted HTML pa
WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
A cookie management issue was addressed with improved state management. Rated medium severity (CVSS 6.3), this vulnerabi
A denial of service vulnerability in This (CVSS 4.2). Risk factors: actively exploited (KEV-listed).
A logic issue was addressed with improved state management. Rated critical severity (CVSS 9.8), this vulnerability is re
An out-of-bounds write issue was addressed with improved input validation. Rated high severity (CVSS 7.8), this vulnerab
Exploit-DB