WebKit EUVD-2026-29266

Requires victim to process attacker-controlled web content via Safari browser or any application using Apple WKWebView rendering engine (email clients rendering HTML emails, in-app browsers, messaging apps displaying link previews). Affects default configurations of all vulnerable iOS, iPadOS, macOS, and visionOS installations-no non-standard features or settings required. Exploitation succeeds against any user who browses to attacker-controlled webpage or views malicious HTML content. What LIMITS exploitation: attack requires user to visit malicious domain or open crafted HTML content (user interaction required despite CVSS UI:N suggesting otherwise-likely vector error). Does not affect devices already updated to patched versions. Enterprise deployments using mobile device management to restrict web access to allowlisted domains reduce attack surface. Vulnerability is specific to WebKit engine-browsers using alternative rendering engines (Chrome on iOS uses WKWebView wrapper but would still be affected; Firefox on macOS uses Gecko and is not vulnerable).

Real-world risk is MODERATE despite 7.5 CVSS score. CRITICAL CONFLICT: CVSS vector shows C:N/I:N/A:H (availability impact only, no confidentiality breach), but description explicitly states 'disclose sensitive user information'-these are incompatible. The vector appears incorrectly assigned; information disclosure should show C:H not A:H. Treating this as information disclosure based on vendor description. Network attack vector (AV:N), low complexity (AC:L), and no privileges required (PR:N) indicate easy remote exploitation against any user visiting attacker-controlled websites. However, no user interaction requirement (UI:N) conflicts with typical web-based attacks requiring victim to visit malicious page-likely scoring error should be UI:R. EPSS 0.02% (5th percentile) suggests minimal exploitation interest, no public POCs identified, and absence from CISA KEV confirms no widespread active exploitation. Attack requires only hosting malicious web content, making it automatable (SSVC: yes), but low real-world exploitation indicates limited attacker interest. Technical impact of information disclosure is significant for targeted attacks (credential theft, session hijacking, cross-site data leakage). Priority: Medium-patch during normal maintenance windows unless processing untrusted web content in high-security contexts.

Attacker registers domain and hosts webpage containing specially crafted JavaScript or HTML designed to exploit WebKit access restriction weakness. Victim visits malicious site using Safari on vulnerable iOS, macOS, or visionOS device, or opens webpage in any application using WKWebView framework. Malicious web content executes and bypasses same-origin policy or other isolation boundaries, accessing sensitive data from other browser contexts, cookies, local storage, or cross-site resources. Extracted information could include authentication tokens, personal data from other tabs, or content from privileged browser contexts. No public exploit code identified, but network attack vector with no authentication requirement makes remote exploitation straightforward once technical details are reverse-engineered from patches.