Skip to main content

Safari CVE-2026-20691

| EUVDEUVD-2026-15062 MEDIUM
Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)
2026-03-25 apple GHSA-rqx2-8fr2-c94c
Information Disclosure Apple iOS macOS Red Hat Safari Suse
4.3
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-497
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection System info exposure prevention
Impact

While CVSS, CVSS vector, and EPSS scores are not available, the vulnerability carries moderate real-world risk due to its broad attack surface and passive exploitation nature. The attack vector is network-based (malicious webpage) with likely low complexity, requiring only that a user visit a crafted page—no user interaction beyond normal browsing is implied. The impact is limited to information disclosure (fingerprinting), not code execution or privilege escalation. The vulnerability is not listed in CISA's KEV catalog, suggesting no widespread active exploitation at the time of disclosure. However, the fix's simultaneous rollout across five major Apple platforms (Safari, iOS, iPadOS, macOS, visionOS, watchOS) indicates this was prioritized as a security issue affecting user privacy. The passive nature and privacy impact (fingerprinting enables persistent tracking) make this a real concern for user privacy and tracking mitigation, even if not immediately critical for confidentiality or integrity of data.
Exploit ScenarioDerived

An attacker creates a malicious website and advertises it via legitimate-looking content or social engineering. When a user visits the site, JavaScript embedded in the webpage exploits the state management vulnerability to fingerprint the user's browser and device without any visible indication to the user. The attacker collects this fingerprint data (e.g., device model, browser version, OS build, unique identifiers) and correlates it with the user's IP address and browsing behavior, enabling persistent tracking across visits and websites. This fingerprint can then be sold to ad networks or data brokers, or used for targeted phishing and social engineering attacks against the identified user.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 25, 2026

An authorization and state management flaw in Apple's WebKit browser engine allows maliciously crafted webpages to fingerprint users by exploiting improper state handling during web interactions. This vulnerability affects Safari 26.4, iOS 26.4, iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4, and watchOS 26.4 across all Apple platforms. An attacker can exploit this by hosting a specially crafted webpage that leverages the state management weakness to extract browser or device identifiers without user knowledge, enabling user tracking and profiling attacks. No CVSS score, EPSS data, or public proof-of-concept details are currently available, though Apple has released fixes across all affected platforms.

RemediationAI

Immediately upgrade Safari to version 26.4 or later, iOS to version 26.4 or later, iPadOS to version 26.4 or later, macOS to Tahoe 26.4 or later, visionOS to version 26.4 or later, and watchOS to version 26.4 or later depending on affected devices. Users should enable automatic security updates in Settings > General > Software Update > Automatic Updates (iOS/iPadOS/watchOS) or System Settings > General > Software Update (macOS) to ensure timely patching. Until updates are applied, users concerned about fingerprinting should enable Safari's Privacy Mode or use enhanced tracking prevention settings; however, this does not fully mitigate the vulnerability as it relates to state management issues rather than traditional tracking. Organizations managing Apple devices should deploy Mobile Device Management (MDM) or Mac Management profiles to enforce automatic OS and Safari updates across their fleet. Consult the official Apple security advisories linked in the affected products section for platform-specific patch details.

Affected VersionsENISA

Safari 0 <26.4
macOS 0 <26.4
watchOS 0 <26.4
iOS and iPadOS 0 <26.4
visionOS 0 <26.4

Affected Packages

euvd ios_and_ipados fix: 26.4
euvd macos fix: 26.4
euvd safari fix: 26.4
euvd visionos fix: 26.4
euvd watchos fix: 26.4

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 5 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability resides in WebKit, Apple's rendering engine used across Safari, iOS Safari, and other Apple platforms (confirmed via multiple CPE entries: cpe:2.3:a:apple:safari, cpe:2.3:a:apple:ios_and_ipados, cpe:2.3:a:apple:macos, cpe:2.3:a:apple:visionos, cpe:2.3:a:apple:watchos). The root cause is classified as an authorization issue exacerbated by inadequate state management—likely related to how the browser maintains and validates security-critical state during cross-origin interactions or session handling. Rather than a traditional authentication bypass, this appears to be an information disclosure vulnerability where improper state validation allows a webpage to infer or extract device/browser fingerprinting data that should remain hidden or require explicit authorization.

Know when Safari gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 4.3 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
SUSE MEDIUM
Red Hat 4.3 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

2
Patch released
Apr 09, 2026 - 14:30 nvd
Patch available
CVE Published
Mar 25, 2026 - 00:35 nvd
MEDIUM 4.3

DescriptionCVE.org

An authorization issue was addressed with improved state management. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4, watchOS 26.4. A maliciously crafted webpage may be able to fingerprint the user.

Executive ViewAI

Why It Matters

Organizations using An authorization should be aware of moderate risk from CVE-2026-20691 rated CVSS 4.3. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.

Business Impact: Low
Compensating Controls

Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Defer
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
Low
Technical Impact
Partial

Priority Score

22
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +22
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Related Vulnerabilities in macOS Tahoe 26.4 Security Updates

View all 67
CVE-2026-28864 LOW
3.3
CVE-2026-28839 MEDIUM
5.3
CVE-2026-28879 MEDIUM
6.5
CVE-2026-20695 MEDIUM
6.2
CVE-2026-28825 HIGH
7.1
CVE-2026-28844 MEDIUM
6.5
CVE-2026-20665 MEDIUM
6.5
CVE-2026-20668 MEDIUM
5.5
CVE-2026-28835 MEDIUM
6.5
CVE-2026-28841 MEDIUM
6.2
CVE-2026-20694 MEDIUM
5.5
CVE-2026-20607 MEDIUM
4.0
CVE-2026-20632 MEDIUM
5.3
CVE-2026-20637 MEDIUM
6.2
CVE-2026-20651 MEDIUM
6.2
CVE-2026-20686 MEDIUM
5.3
CVE-2026-20687 HIGH
7.1
CVE-2026-20688 CRITICAL
9.3
CVE-2026-20692 MEDIUM
5.3
CVE-2026-20693 MEDIUM
4.9
CVE-2026-20698 HIGH
7.8
CVE-2026-20699 MEDIUM
6.2
CVE-2026-20701 HIGH
7.5
CVE-2026-28816 MEDIUM
4.0
CVE-2026-28818 MEDIUM
5.3
CVE-2026-28820 MEDIUM
5.3
CVE-2026-28821 HIGH
8.4
CVE-2026-28822 MEDIUM
6.2
CVE-2026-28823 MEDIUM
4.9
CVE-2026-28827 CRITICAL
9.3
CVE-2026-28828 MEDIUM
5.3
CVE-2026-28829 MEDIUM
5.5
CVE-2026-28831 MEDIUM
5.5
CVE-2026-28832 HIGH
8.4
CVE-2026-28837 HIGH
7.5
CVE-2026-28842 HIGH
7.5
CVE-2026-28852 MEDIUM
5.5
CVE-2026-28862 MEDIUM
5.3
CVE-2026-28865 HIGH
7.5
CVE-2026-28866 MEDIUM
6.2
CVE-2026-28868 MEDIUM
5.5
CVE-2026-28886 MEDIUM
5.9
CVE-2026-28892 MEDIUM
5.5
CVE-2026-28893 LOW
3.3
CVE-2026-28894 HIGH
7.5
CVE-2025-43534 MEDIUM
6.8
CVE-2026-20690 MEDIUM
6.5
CVE-2026-28824 MEDIUM
5.3
CVE-2026-28833 MEDIUM
6.2
CVE-2026-28834 MEDIUM
5.1
CVE-2026-20633 MEDIUM
5.5
CVE-2026-20631 HIGH
8.8
CVE-2026-28817 HIGH
8.1
CVE-2026-20639 HIGH
7.5
CVE-2026-20664 MEDIUM
4.3
CVE-2026-28859 MEDIUM
4.3
CVE-2026-28861 MEDIUM
4.3
CVE-2026-20684 LOW
3.3
CVE-2026-28838 MEDIUM
5.3
CVE-2026-20657 MEDIUM
6.5
CVE-2026-28826 MEDIUM
4.0
CVE-2026-28877 MEDIUM
5.5
CVE-2026-28878 MEDIUM
6.5
CVE-2026-28882 MEDIUM
4.0
CVE-2026-20622 HIGH
7.5

More in Safari

View all
CVE-2017-2547 HIGH POC
8.8 May 22

An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
CVE-2014-1303 CRITICAL POC
10.0 Mar 26

Heap-based buffer overflow in Apple Safari 7.0.2 allows remote attackers to execute arbitrary code and bypass a sandbox

CVE-2016-4622 HIGH
8.8 Jul 22

WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
CVE-2015-1155 MEDIUM POC
4.3 May 08

The history implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allo
CVE-2015-1126 MEDIUM POC
4.3 Apr 10

WebKit, as used in Apple iOS before 8.3 and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, does not

CVE-2017-2446 HIGH POC
8.8 Apr 02

An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
CVE-2017-13802 HIGH POC
8.8 Nov 13

An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
CVE-2017-13795 HIGH POC
8.8 Nov 13

An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
CVE-2017-13794 HIGH POC
8.8 Nov 13

An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
CVE-2017-13792 HIGH POC
8.8 Nov 13

An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
CVE-2017-13785 HIGH POC
8.8 Nov 13

An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
CVE-2017-13784 HIGH POC
8.8 Nov 13

An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi

Same weakness CWE-497 – Exposure of Sensitive System Information to an Unauthorized Control Sphere

View all
CVE-2026-34413 HIGH POC
8.8
CVE-2026-41459 MEDIUM POC
6.9
CVE-2025-44823 HIGH POC
8.8
CVE-2022-1902 HIGH POC
8.8
CVE-2022-4985 HIGH POC
8.7
CVE-2018-25358 HIGH POC
8.7
CVE-2020-36922 HIGH POC
7.5
CVE-2020-36926 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-20691 ADVISORY https://vuldb.com/vuln/352916 REF https://support.apple.com/en-us/126792 REF https://support.apple.com/en-us/126794 REF https://support.apple.com/en-us/126798 REF https://support.apple.com/en-us/126799 REF https://support.apple.com/en-us/126800

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy