EUVD-2026-40186
GHSA-jh53-f58v-32wv
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Remote malicious page, no auth, but requires the victim to visit it (UI:R); described impact is cross-origin data read only, so C:H with I:N and A:N.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. A malicious website may exfiltrate data cross-origin.
AnalysisAI
Cross-origin data exfiltration in Apple's Safari/WebKit engine (Safari, iOS/iPadOS, and macOS Tahoe before 26.5.2) allows a malicious website to bypass the same-origin policy and read data belonging to other origins after a victim is lured into visiting it. Tracked under CWE-352 and rated CVSS 8.1, the flaw requires user interaction (visiting the attacker page) but no authentication or elevated privileges. No public exploit identified at time of analysis; EPSS is low at 0.17% and CISA SSVC records exploitation status as none.
Technical ContextAI
The vulnerability resides in Apple's WebKit browser engine, which underpins Safari on macOS and every browser on iOS/iPadOS. The affected CPEs - apple:safari, apple:ios_and_ipados, and apple:macos - indicate the same underlying WebKit code shipped across all three platforms. The root cause class is CWE-352 (Cross-Site Request Forgery); in this case it manifests as a same-origin-policy / cross-origin isolation weakness that lets script on one origin obtain data from a different origin. Apple states the issue was addressed with 'improved checks,' consistent with a missing or insufficient origin/permission validation being added in the patched build.
RemediationAI
Vendor-released patch: update to Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2, which Apple states fix the issue via improved checks. Apply these updates across all Apple endpoints and browsers, since the same WebKit engine is affected on every platform; consult Apple's advisories at https://support.apple.com/en-us/127594, https://support.apple.com/en-us/127595, and https://support.apple.com/en-us/127685 for the platform-specific builds. There is no vendor-documented configuration workaround because the flaw is in the browser engine itself; as an interim compensating control until updates are deployed, restrict use of the vulnerable Safari/WebKit browsers for untrusted web browsing (e.g., steer users to an already-patched alternative browser on macOS, or enforce Lockdown Mode on iOS/iPadOS/macOS which hardens WebKit attack surface at the cost of reduced web functionality) and reinforce user awareness against visiting untrusted links, since exploitation requires the victim to load an attacker-controlled page.
More in Ios And Ipados
View allLocal privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Denial of service via unexpected app termination affects multiple Apple operating systems, including iOS, iPadOS, macOS,
A data protection flaw in multiple Apple operating systems allows a locally-installed app to fingerprint the user. An at
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Se
Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today