Apple WebKit CVE-2026-86872

Exploitation requires the victim to process attacker-controlled web content in the WebKit-based browser engine on an affected product (Safari, visionOS, or watchOS prior to version 27) - i.e., the user must navigate to or render a malicious page (UI:R). No authentication is required (PR:N). Limiting factors: the mandatory user-interaction step means there is no fully automatic drive-by without victim action, the impact is capped at low confidentiality and low availability (no integrity impact, no indication of reliable code execution), and only pre-27 versions on the three named Apple platforms are affected - patched or auto-updated devices are not exposed.

Multiple signals converge on this being a MODERATE, low-urgency issue rather than a top priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L, base 5.4) describes a network-reachable, unauthenticated flaw that nonetheless REQUIRES user interaction (UI:R) - the victim must process maliciously crafted web content - and yields only low confidentiality and low availability impact with no integrity impact. EPSS reinforces low real-world risk: 0.16% probability at only the 5th percentile. The CVE is NOT on CISA KEV and no public POC is referenced, so there is no public exploit identified at time of analysis. CWE-843 (type confusion) combined with the vendor's phrasing ('logic issue addressed with improved state management', 'may lead to unexpected behavior') suggests a WebKit/Safari engine state-confusion bug whose practical impact Apple has characterized conservatively. No SSVC decision data was supplied in the input. One tension worth noting: the input Tags include 'Memory Corruption' and 'Information Disclosure', yet the official CVSS impact is only C:L/I:N/A:L and the description says merely 'unexpected behavior' - this does not read as reliable code execution or significant memory corruption, so treat the 'Memory Corruption' tag as aspirational rather than confirmed. Overall: a genuine but low-severity browser-engine bug best handled via routine patching, not emergency response.

An attacker hosts a malicious web page (or injects crafted content into a compromised or ad-served page) that triggers a type-confusion/state-management flaw in the Safari/WebKit engine. A victim using an affected Safari, visionOS, or watchOS version visits or renders the page, causing unexpected engine behavior that may leak limited information or disrupt the browser. No public exploit code is referenced, and successful exploitation depends on the user actually loading attacker-controlled content (UI:R).