Skip to main content

Safari EUVDEUVD-2026-15051

| CVE-2026-20665 MEDIUM
Protection Mechanism Failure (CWE-693)
2026-03-25 apple GHSA-w9qh-3c3h-mc7x
Information Disclosure Apple iOS macOS Red Hat Safari Suse
6.5
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-693
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Protection mechanism completeness
Impact

Despite the absence of CVSS score and EPSS data, this vulnerability carries substantial real-world risk due to several converging signals. The attack vector is network-based (requires delivering malicious web content) with likely low complexity, making it accessible to a broad threat actor base. The scope is changed given that CSP bypass affects the security posture of all web content consumed through affected browsers. The patch availability across multiple product versions (Safari 26.4, iOS/iPadOS 18.7.7 and 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4) suggests this was a confirmed issue that Apple prioritized for coordinated disclosure, typical of vulnerabilities with known exploitation potential. The fact that the fix required architectural changes to state management indicates this was not a trivial implementation error but rather a logic flaw in core security policy handling. In the SSVC framework, this would likely score as exploitable (network delivery is automatic), non-automatable (requires crafted content for specific scenarios), with technical impact on data confidentiality and integrity through CSP bypass. This is a genuine priority for patching rather than a theoretical high-CVSS issue, particularly for users frequently visiting untrusted websites.
Exploit ScenarioDerived

An attacker crafts a malicious web page designed to deliver JavaScript payloads that would normally be blocked by the website's Content Security Policy. When a victim visits this page through Safari or another affected Apple browser, the malformed web content causes the browser's state management for CSP enforcement to fail, allowing the attacker's scripts to execute despite the CSP directives. The attacker can then harvest sensitive information from the page (such as authentication tokens, personal data, or CSRF tokens) and exfiltrate it to a remote server, or perform unauthorized actions on behalf of the user—attacks that CSP is specifically designed to prevent. This is particularly dangerous for users accessing sensitive websites like online banking, email, or healthcare portals.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 25, 2026

This vulnerability allows attackers to bypass Content Security Policy (CSP) enforcement in Apple's WebKit engine through maliciously crafted web content, affecting Safari and all Apple platforms including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The vulnerability stems from improper state management during web content processing, enabling attackers to circumvent a critical security control that prevents injection attacks and unauthorized script execution. While no CVSS score or EPSS data is currently available, the broad platform impact across Apple's entire ecosystem and the fundamental nature of CSP bypass as an information disclosure vector indicate significant real-world risk.

RemediationAI

Immediately upgrade Safari to version 26.4 or later. For iOS and iPadOS users, install security updates 18.7.7 or 26.4 depending on device eligibility. macOS users should upgrade to Tahoe 26.4, while tvOS, visionOS, and watchOS users should update to version 26.4 respectively. Because this vulnerability affects core web content processing, all patches should be applied urgently to prevent CSP bypass exploitation. Until patches can be deployed, users should limit browsing to trusted websites and disable JavaScript execution in browser settings if feasible, though this significantly impacts web functionality. For enterprises, consider deploying web content filtering at network boundaries to block delivery of potentially malicious web content. All patching information and version-specific advisories are available at the Apple support URLs listed in the affected products section.

Affected VersionsENISA

watchOS 0 <26.4
Safari 0 <26.4
iOS and iPadOS 0 <26.4
iOS and iPadOS 0 <18.7.7
visionOS 0 <26.4
macOS 0 <26.4
tvOS 0 <26.4

Affected Packages

euvd ios_and_ipados fix: 18.7.7, 26.4
euvd macos fix: 26.4
euvd safari fix: 26.4
euvd tvos fix: 26.4
euvd visionos fix: 26.4
euvd watchos fix: 26.4

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 6 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability relates to WebKit's Content Security Policy implementation, which is a critical HTTP header-based security mechanism that restricts the sources from which content can be loaded and executed in web pages. The root cause involves improper state management (likely related to policy initialization, inheritance, or enforcement tracking across document lifecycle events) in how Safari and WebKit-based browsers process and maintain CSP directives when handling specially crafted web content. The affected products span Apple's entire platform portfolio via CPE strings (cpe:2.3:a:apple:safari, cpe:2.3:a:apple:ios_and_ipados, cpe:2.3:a:apple:macos, cpe:2.3:a:apple:tvos, cpe:2.3:a:apple:visionos, cpe:2.3:a:apple:watchos), indicating the vulnerability exists in a shared WebKit component that powers all these implementations. The classification as Information Disclosure suggests the bypass enables attackers to exfiltrate data that CSP would normally protect against.

Know when Safari gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
SUSE MEDIUM
Red Hat 5.4 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
Low

Lifecycle Timeline

2
Patch released
Apr 09, 2026 - 14:30 nvd
Patch available
CVE Published
Mar 25, 2026 - 00:32 nvd
MEDIUM 6.5

DescriptionCVE.org

This issue was addressed through improved state management. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.

Executive ViewAI

Why It Matters

Organizations using This should be aware of notable risk from CVE-2026-20665, a protection bypass vulnerability rated CVSS 6.5. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.

Business Impact: Moderate
Compensating Controls

Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.

Threat Intelligence Overview

EPSS Score
0.0%
Top 90% exploitable
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Technical Impact
Partial

Priority Score

32
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +32
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Related Vulnerabilities in macOS Tahoe 26.4 Security Updates

View all 67
CVE-2026-28839 MEDIUM
5.3
CVE-2026-28879 MEDIUM
6.5
CVE-2026-20695 MEDIUM
6.2
CVE-2026-28825 HIGH
7.1
CVE-2026-28844 MEDIUM
6.5
CVE-2026-20668 MEDIUM
5.5
CVE-2026-28835 MEDIUM
6.5
CVE-2026-28841 MEDIUM
6.2
CVE-2026-28864 LOW
3.3
CVE-2026-20694 MEDIUM
5.5
CVE-2026-20607 MEDIUM
4.0
CVE-2026-20632 MEDIUM
5.3
CVE-2026-20637 MEDIUM
6.2
CVE-2026-20651 MEDIUM
6.2
CVE-2026-20686 MEDIUM
5.3
CVE-2026-20687 HIGH
7.1
CVE-2026-20688 CRITICAL
9.3
CVE-2026-20691 MEDIUM
4.3
CVE-2026-20692 MEDIUM
5.3
CVE-2026-20693 MEDIUM
4.9
CVE-2026-20698 HIGH
7.8
CVE-2026-20699 MEDIUM
6.2
CVE-2026-20701 HIGH
7.5
CVE-2026-28816 MEDIUM
4.0
CVE-2026-28818 MEDIUM
5.3
CVE-2026-28820 MEDIUM
5.3
CVE-2026-28821 HIGH
8.4
CVE-2026-28822 MEDIUM
6.2
CVE-2026-28823 MEDIUM
4.9
CVE-2026-28827 CRITICAL
9.3
CVE-2026-28828 MEDIUM
5.3
CVE-2026-28829 MEDIUM
5.5
CVE-2026-28831 MEDIUM
5.5
CVE-2026-28832 HIGH
8.4
CVE-2026-28837 HIGH
7.5
CVE-2026-28842 HIGH
7.5
CVE-2026-28852 MEDIUM
5.5
CVE-2026-28862 MEDIUM
5.3
CVE-2026-28865 HIGH
7.5
CVE-2026-28866 MEDIUM
6.2
CVE-2026-28868 MEDIUM
5.5
CVE-2026-28886 MEDIUM
5.9
CVE-2026-28892 MEDIUM
5.5
CVE-2026-28893 LOW
3.3
CVE-2026-28894 HIGH
7.5
CVE-2025-43534 MEDIUM
6.8
CVE-2026-20690 MEDIUM
6.5
CVE-2026-28824 MEDIUM
5.3
CVE-2026-28833 MEDIUM
6.2
CVE-2026-28834 MEDIUM
5.1
CVE-2026-20633 MEDIUM
5.5
CVE-2026-20631 HIGH
8.8
CVE-2026-28817 HIGH
8.1
CVE-2026-20639 HIGH
7.5
CVE-2026-20664 MEDIUM
4.3
CVE-2026-28859 MEDIUM
4.3
CVE-2026-28861 MEDIUM
4.3
CVE-2026-20684 LOW
3.3
CVE-2026-28838 MEDIUM
5.3
CVE-2026-20657 MEDIUM
6.5
CVE-2026-28826 MEDIUM
4.0
CVE-2026-28877 MEDIUM
5.5
CVE-2026-28878 MEDIUM
6.5
CVE-2026-28882 MEDIUM
4.0
CVE-2026-20622 HIGH
7.5

More in Safari

View all
CVE-2017-2547 HIGH POC
8.8 May 22

An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
CVE-2014-1303 CRITICAL POC
10.0 Mar 26

Heap-based buffer overflow in Apple Safari 7.0.2 allows remote attackers to execute arbitrary code and bypass a sandbox

CVE-2016-4622 HIGH
8.8 Jul 22

WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
CVE-2015-1155 MEDIUM POC
4.3 May 08

The history implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allo
CVE-2015-1126 MEDIUM POC
4.3 Apr 10

WebKit, as used in Apple iOS before 8.3 and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, does not

CVE-2017-2446 HIGH POC
8.8 Apr 02

An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
CVE-2017-13802 HIGH POC
8.8 Nov 13

An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
CVE-2017-13795 HIGH POC
8.8 Nov 13

An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
CVE-2017-13794 HIGH POC
8.8 Nov 13

An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
CVE-2017-13792 HIGH POC
8.8 Nov 13

An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
CVE-2017-13785 HIGH POC
8.8 Nov 13

An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
CVE-2017-13784 HIGH POC
8.8 Nov 13

An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi

Same weakness CWE-693 – Protection Mechanism Failure

View all
CVE-2013-2465 CRITICAL POC
9.8
CVE-2024-21412 HIGH POC
8.1
CVE-2019-1003030 CRITICAL POC
9.9
CVE-2013-0431 LOW POC
3.7
CVE-2025-40536 HIGH POC
8.1
CVE-2024-38217 MEDIUM POC
5.4
CVE-2026-21513 HIGH
8.8
CVE-2026-21510 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-20665 ADVISORY https://vuldb.com/vuln/352904 REF https://support.apple.com/en-us/126792 REF https://support.apple.com/en-us/126793 REF https://support.apple.com/en-us/126794 REF https://support.apple.com/en-us/126797 REF https://support.apple.com/en-us/126798 REF https://support.apple.com/en-us/126799 REF https://support.apple.com/en-us/126800

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy