EUVD-2026-29272
GHSA-rjgv-f67w-7wg6
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network delivery via webpage requires only user visit (UI:R); no auth needed (PR:N); impact is partial confidentiality only via download settings leakage, no integrity or availability consequence.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
The issue was addressed with improved UI handling. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5. A malicious iframe may use another website’s download settings.
AnalysisAI
Cross-origin iframe download settings confusion in Apple WebKit allows a malicious iframe to inherit or apply another website's download configuration, effectively bypassing per-origin download policy isolation. Affected platforms include iOS/iPadOS, macOS Tahoe, and visionOS prior to their respective 26.5 releases. EPSS sits at 0.02% (4th percentile), SSVC exploitation status is 'none', and no KEV listing or public proof-of-concept exists, placing real-world exploitation risk well below what the network-accessible CVSS vector alone might suggest.
Technical ContextAI
CWE-1021 (Improper Restriction of Rendered UI Layers or Frames) covers UI redressing and iframe-based origin confusion - the root cause here is that WebKit failed to enforce strict per-origin isolation of download configuration state when an embedded iframe from one origin could access or influence the download settings associated with a different origin. Affected components span Apple's cross-platform WebKit engine as shipped in Safari across cpe:2.3:a:apple:ios_and_ipados, cpe:2.3:a:apple:macos, and cpe:2.3:a:apple:visionos. Download settings in browsers can encompass automatic download triggers, save-as prompts, and file-type handling policies; leaking these across origins violates the same-origin policy intent and could allow a malicious site to initiate or manipulate downloads as if acting under a trusted site's permissions. The 'addressed with improved UI handling' language from Apple confirms the fix was a policy enforcement correction in the rendering layer rather than a cryptographic or memory-safety fix.
RemediationAI
The primary fix is to update to iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, or visionOS 26.5, as confirmed by Apple's vendor advisories at https://support.apple.com/en-us/127110, https://support.apple.com/en-us/127115, https://support.apple.com/en-us/127120, and https://support.apple.com/en-us/127121. No workarounds are documented by Apple. Organizations that cannot immediately patch may reduce exposure by enforcing enterprise content filtering to block untrusted iframe-heavy web content or restricting Safari usage to managed, allowlisted sites - though these controls degrade user experience and do not eliminate risk. Given the low EPSS and absence of active exploitation, patching through normal patch cycle cadence (rather than emergency deployment) is appropriate for most environments.
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
A critical out-of-bounds write in WebKit's rendering engine allows maliciously crafted web content to escape the Web Con
Arbitrary code execution in Apple Safari, iOS/iPadOS, macOS Sequoia, and visionOS occurs when processing maliciously cra
A cookie management issue was addressed with improved state management. Rated medium severity (CVSS 6.3), this vulnerabi
An out-of-bounds write issue was addressed with improved input validation. Rated high severity (CVSS 7.8), this vulnerab
Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
The issue was addressed with improved memory handling. Rated critical severity (CVSS 9.8), this vulnerability is remotel
A correctness issue was addressed with improved checks. Rated critical severity (CVSS 9.8), this vulnerability is remote
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Share
External POC / Exploit Code
Leaving vuln.today