Apple Safari CVE-2026-86922

Exploitation requires the victim to process attacker-controlled web content in a vulnerable version of Apple's WebKit - i.e., opening a malicious or compromised web page in Safari, or any app/WebView embedding WebKit, on iOS/iPadOS, macOS, or visionOS below version 27 (Safari below 27). The required user interaction (UI:R - the victim must navigate to the content) is the main limiting factor; there is no authentication requirement (PR:N). No non-default configuration is needed - default browsing behavior is sufficient. Installing Safari 27, iOS/iPadOS 27, macOS Golden Gate 27, or visionOS 27 removes the condition.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) describes a network-reachable, low-complexity, unauthenticated flaw requiring only user interaction (visiting a malicious page), with high confidentiality, integrity and availability impact - consistent with a WebKit type-confusion bug leading to arbitrary code execution in the browser rendering process. No EPSS score, no CISA KEV entry, and no POC were supplied in the input, so there is no positive signal of active exploitation or public exploit code; per precision rules this is 'no public exploit identified at time of analysis.' That said, WebKit memory-corruption bugs fixed by Apple historically attract exploit development, and the UI:R requirement (a single click/visit) is a very low practical barrier, so this should be treated as a genuine high priority to patch rather than a nominal high-CVSS issue - the primary mitigating factor is that it is scope-unchanged (S:U), confined to the rendering sandbox absent a chained escape. No SSVC/automatable/technical-impact framework data was provided, and EPSS is absent; those gaps should be resolved before final prioritization but do not lower the vendor-confirmed severity.

An attacker hosts or compromises a web page containing maliciously crafted content that triggers the WebKit type-confusion condition when rendered. A victim using a vulnerable Safari/iOS/iPadOS/macOS/visionOS version simply visits the page (UI:R), and the memory corruption is leveraged to achieve arbitrary code execution in the browser process. No public POC or active-exploitation evidence was provided in the input.