EUVD-2026-65739
GHSA-fxrm-hjf3-m3rr
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered via crafted page (AV:N), no special conditions (AC:L), no authentication (PR:N), user must visit page (UI:R); CSP bypass worst-case enables full script execution impact.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
5DescriptionCVE.org
A Content Security Policy bypass was addressed with improved enforcement in AudioWorklet contexts. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5. Processing maliciously crafted web content may bypass Content Security Policy.
AnalysisAI
Content Security Policy enforcement failure in Safari's AudioWorklet contexts allows remote attackers to bypass CSP restrictions when a user processes maliciously crafted web content. Affected platforms include Safari before 26.5, iOS and iPadOS before 18.7.9/26.5, and macOS Tahoe before 26.5. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a user actively visit or be redirected to a maliciously crafted web page using an affected version of Safari or a WebKit-based browser on iOS, iPadOS, or macOS Tahoe - this is the UI:R (user interaction required) condition from the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 score (AV:N/AC:L/PR:N/UI:R) reflects a realistic threat model: an attacker hosts a malicious page and socially engineers a user to visit it, after which the CSP bypass takes effect with no further authentication required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to update to a patched Apple platform release: Safari 26.5, iOS 18.7.9 or iOS 26.5, iPadOS 18.7.9 or iPadOS 26.5, or macOS Tahoe 26.5, as confirmed by Apple's advisories at https://support.apple.com/en-us/127110 through https://support.apple.com/en-us/127121. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Safari, iOS, iPadOS, and macOS Tahoe versions deployed in your environment to identify affected systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ios And Ipados
View allLocal privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Denial of service via unexpected app termination affects multiple Apple operating systems, including iOS, iPadOS, macOS,
A data protection flaw in multiple Apple operating systems allows a locally-installed app to fingerprint the user. An at
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Se
Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today