EUVD-2026-40219
GHSA-gc99-j9gc-r79x
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network delivery via web content requires only passive user interaction; no privileges needed; high confidentiality impact from cross-origin data leakage; no integrity or availability impact.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
5DescriptionCVE.org
A cross-origin issue was addressed with improved tracking of security origins. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may disclose sensitive user information.
AnalysisAI
Cross-origin information disclosure in Apple Safari, iOS, iPadOS, and macOS Tahoe (all versions before 26.5.2) allows an attacker who can direct a user to maliciously crafted web content to read sensitive data from other origins, violating the Same-Origin Policy. The flaw stems from inadequate tracking of security origins in the WebKit engine (CWE-346), and is notable because on iOS and iPadOS all browsers are mandated to use WebKit, meaning every browser on those platforms is affected. No public exploit or CISA KEV listing is identified at time of analysis; Apple has released patches across all affected platforms.
Technical ContextAI
CWE-346 (Origin Validation Error) describes a failure to correctly track or enforce security origin boundaries - in this case, WebKit's engine-level implementation of the Same-Origin Policy. The Same-Origin Policy is the browser security cornerstone that prevents JavaScript loaded from one origin (scheme + host + port) from reading resources belonging to another. Apple's fix is described as 'improved tracking of security origins,' indicating the engine was either improperly inheriting, propagating, or comparing origin state during cross-origin interactions. CPE data identifies three affected product lines: cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*, cpe:2.3:a:apple:ios_and_ipados:*:*:*:*:*:*:*:*, and cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*. Because Apple requires all iOS and iPadOS browsers to use WebKit rather than their own rendering engines, this vulnerability extends beyond Safari to Chrome, Firefox, and all other third-party browsers on those platforms.
RemediationAI
Apply the vendor-released patches immediately: update Safari to version 26.5.2 or later, iOS and iPadOS to version 26.5.2 or later, and macOS Tahoe to version 26.5.2 or later. Updates are available through Apple Software Update and detailed in advisories at https://support.apple.com/en-us/127594, https://support.apple.com/en-us/127595, and https://support.apple.com/en-us/127685. On iOS and iPadOS, updating the operating system is the only effective remediation since all browsers - not just Safari - rely on the WebKit engine embedded in the OS. As a temporary compensating control pending update, organizations should advise users to avoid browsing untrusted or unfamiliar websites and to be cautious of phishing links; however, this control is imperfect since the flaw resides in the browser engine rather than any user-configurable setting. Sensitive web applications may benefit from enforcing strict Content Security Policy and CORS headers to limit cross-origin exposure, but these server-side mitigations do not eliminate client-side engine risk. Prompt OS and app updates remain the only definitive fix.
More in Ios And Ipados
View allLocal privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Denial of service via unexpected app termination affects multiple Apple operating systems, including iOS, iPadOS, macOS,
A data protection flaw in multiple Apple operating systems allows a locally-installed app to fingerprint the user. An at
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Se
Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today