EUVD-2026-49478
GHSA-8h99-r879-98w4
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Requires user interaction, network accessible, no privileges, integrity impact only.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. A remote attacker may be able to bypass network filters.
AnalysisAI
An inconsistent user interface state management in multiple Apple operating systems allows remote attackers to bypass network filters, potentially leading to unauthorized actions on the system. The vulnerability requires user interaction (e.g., clicking a link) and affects iOS and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. No active exploitation has been reported at this time, and the EPSS score (0.27%, 20th percentile) indicates a low immediate threat.
Technical ContextAI
The vulnerability is classified under CWE-451, which covers user interface (UI) misrepresentation of critical information. The root cause is an inconsistent UI state management flaw, where the interface fails to properly reflect security-relevant states, enabling an attacker to deceive the UI into applying incorrect network filter rules. The CPE data confirms affected products span the entire Apple mobile and desktop ecosystem, including iOS/iPadOS, macOS, tvOS, visionOS, and watchOS. This class of vulnerability often arises from race conditions or incomplete state transitions in the UI layer, leading to security policy bypasses.
RemediationAI
Vendor-released patch: upgrade iOS and iPadOS to version 26.6, macOS Sequoia to 15.7.8, macOS Sonoma to 14.8.8, macOS Tahoe to 26.6, tvOS to 26.6, watchOS to 26.6, and visionOS to 26.6. No workarounds have been published; applying the latest OS updates via Apple's Software Update mechanism is the recommended remediation. Confirm installation through the device's settings or MDM tools.
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo
An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
An issue was discovered in certain Apple products. Rated critical severity (CVSS 9.8), this vulnerability is remotely ex
An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
The IOHIDFamily API in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attacke
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today