EUVD-2026-40186
GHSA-jh53-f58v-32wv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious website
-
DeliveryLoad attacker page in unpatched WebKit
-
ExploitBypass same-origin checks via CSRF flaw
-
ExecutionRead cross-origin data in browser
-
ImpactExfiltrate stolen data to attacker
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Anti-CSRF tokens, SameSite cookies
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively visit or load an attacker-controlled web page in an unpatched Safari or WebKit-based browser on Safari, iOS/iPadOS, or macOS below version 26.5.2 (UI:R user interaction is mandatory). No authentication, credentials, or elevated privileges on the target device are needed (PR:N), and the attack works against default browser configurations with no special feature toggle required. The primary limiting factors are the required user interaction (the user must open the malicious site) and that value depends on the victim being concurrently logged into or having accessible data at another origin worth stealing cross-origin; there is no self-propagating or automatable path (SSVC Automatable: no). |
| Impact | The signals are mixed and lean toward moderate real-world priority rather than emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, score 8.1) reflects a network-reachable, low-complexity, unauthenticated attack whose main brake is required user interaction (UI:R) - the victim must visit a malicious page. Counterbalancing the high CVSS, EPSS is very low (0.17%, 6th percentile), the vulnerability is not in CISA KEV, and SSVC records Exploitation: none and Automatable: no, while rating Technical Impact: total. The picture is therefore a high-impact-if-exploited but currently-not-exploited browser bug typical of Apple's coordinated WebKit disclosures. One caveat: the CVSS lists C:H and I:H, yet the description only describes cross-origin data *exfiltration* (a read/confidentiality outcome), so the integrity-high rating is not clearly justified by the public description - verify with Apple before treating this as a data-tampering issue. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page and lures a victim (via phishing link, malvertising, or a compromised site) into opening it in an unpatched Safari/WebKit browser. Script on the attacker's origin abuses the flawed cross-origin checks to read data belonging to another site the victim is authenticated to, exfiltrating it back to the attacker. No public proof-of-concept has been identified, and the attack succeeds only after the user interaction of visiting the page. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Cross-origin data exfiltration in Apple's Safari/WebKit engine (Safari, iOS/iPadOS, and macOS Tahoe before 26.5.2) allows a malicious website to bypass the same-origin policy and read data belonging to other origins after a victim is lured into visiting it. Tracked under CWE-352 and rated CVSS 8.1, the flaw requires user interaction (visiting the attacker page) but no authentication or elevated privileges. No public exploit identified at time of analysis; EPSS is low at 0.17% and CISA SSVC records exploitation status as none.
RemediationAI
Vendor-released patch: update to Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2, which Apple states fix the issue via improved checks. Apply these updates across all Apple endpoints and browsers, since the same WebKit engine is affected on every platform; consult Apple's advisories at https://support.apple.com/en-us/127594, https://support.apple.com/en-us/127595, and https://support.apple.com/en-us/127685 for the platform-specific builds. There is no vendor-documented configuration workaround because the flaw is in the browser engine itself; as an interim compensating control until updates are deployed, restrict use of the vulnerable Safari/WebKit browsers for untrusted web browsing (e.g., steer users to an already-patched alternative browser on macOS, or enforce Lockdown Mode on iOS/iPadOS/macOS which hardens WebKit attack surface at the cost of reduced web functionality) and reinforce user awareness against visiting untrusted links, since exploitation requires the victim to load an attacker-controlled page.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Apple's WebKit browser engine, which underpins Safari on macOS and every browser on iOS/iPadOS. The affected CPEs - apple:safari, apple:ios_and_ipados, and apple:macos - indicate the same underlying WebKit code shipped across all three platforms. The root cause class is CWE-352 (Cross-Site Request Forgery); in this case it manifests as a same-origin-policy / cross-origin isolation weakness that lets script on one origin obtain data from a different origin. Apple states the issue was addressed with 'improved checks,' consistent with a missing or insufficient origin/permission validation being added in the patched build.
Know when Ios And Ipados gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Remote malicious page, no auth, but requires the victim to visit it (UI:R); described impact is cross-origin data read only, so C:H with I:N and A:N.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
3DescriptionCVE.org
The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. A malicious website may exfiltrate data cross-origin.
Executive ViewAI
A cross-origin data exfiltration vulnerability in Apple's Safari browser (macOS, iOS, iPadOS) allows unauthenticated users to bypass the same-origin policy and access sensitive data from other websites through user interaction. This threatens the confidentiality of user data across web applications-including financial, email, and corporate SaaS platforms-for any organization whose employees or customers use affected Safari versions.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
More in Ios And Ipados
View allOut-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Integer overflow in Apple operating systems allows remote unauthenticated attackers to crash devices via maliciously cra
An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Kernel memory corruption in Apple's operating systems lets an app already running on a device trigger a double free (CWE
Exploit-DB