Apple Safari EUVD-2026-40215

| CVE-2026-43721 MEDIUM

Incorrect Permission Assignment for Critical Resource (CWE-732)

2026-06-29 apple

GHSA-w4j5-xp5j-wg64

Information Disclosure Apple Ios And Ipados

6.5

CVSS 3.1 · Vendor: apple

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Lure victim to malicious website
Delivery

Page invokes WebKit clipboard read API
Exploit

Permission-state check bypassed
Execution

Read clipboard contents silently
Impact

Exfiltrate copied secrets to attacker server

Vulnerability Assessment

Weakness	CWE CWE-732 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V13 - Configuration Permission assignment review
Exploitation Conditions	The victim must visit an attacker-controlled or compromised website using a vulnerable Safari/WebKit build (Safari, iOS, iPadOS, or macOS before 26.5.2) - that is the only prerequisite, with no authentication, permission prompt, or user gesture required (AV:N/AC:L/PR:N/UI:N). Exploitation value is limited by what is actually present on the clipboard at the time of the visit: the attack only yields whatever the user has recently copied, so impact depends on the victim copying sensitive data near the time of browsing. The limiting factor is therefore timing and clipboard contents rather than any special target configuration.
Impact	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) describes a network-reachable, low-complexity, unauthenticated attack requiring no user interaction, with high confidentiality impact but no integrity or availability impact - consistent with silent clipboard theft. However, the description's phrase 'silently hijack clipboard data' implies write/modification (integrity), which would not be captured by the C:H/I:N rating; this is a mild inconsistency worth noting (the scored impact is read-disclosure, while 'hijack' could suggest tampering). No EPSS score, SSVC decision, KEV listing, or POC was provided, so probability of exploitation cannot be quantified from the input. Real-world risk is moderate: the bar to exploit is low and Safari is ubiquitous, but the impact is limited to whatever a victim happens to have copied (which can be high-value - passwords, 2FA codes, crypto addresses) and there is no code execution. This is a genuine 'patch promptly' item rather than an emergency, absent evidence of active exploitation.
Exploit ScenarioDerived	A user copies a password or one-time code to the clipboard and then visits a malicious or compromised web page in a vulnerable Safari/WebKit build. The page programmatically reads the clipboard with no prompt or click, exfiltrating the copied secret to an attacker-controlled server. No POC is publicly identified, but the low attack complexity and absence of required user interaction make weaponization straightforward.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

AnalysisAIv1 – Jun 30, 2026

Clipboard data disclosure in Apple Safari (and the shared WebKit engine on iOS, iPadOS, and macOS) before version 26.5.2 lets a malicious website silently read or hijack clipboard contents without user interaction or permission, rated CVSS 7.5 (confidentiality-only). Apple has shipped fixes in Safari 26.5.2, iOS/iPadOS 26.5.2, and macOS Tahoe 26.5.2, and the issue was reported internally by Apple. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

RemediationAI

Vendor-released patch: update to Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, or macOS Tahoe 26.5.2 as applicable to the device, per Apple's advisories at https://support.apple.com/en-us/127594, https://support.apple.com/en-us/127595, and https://support.apple.com/en-us/127685. Because all three OS/browser updates share the fix, ensure every Apple endpoint in the fleet is brought current. No vendor workaround is published; as interim compensating controls before patching, avoid copying sensitive secrets (passwords, 2FA codes, recovery phrases) to the clipboard while browsing untrusted sites, and clear the clipboard after pasting sensitive values - these reduce the value of any silent read but do not close the flaw and degrade usability for password-manager copy/paste workflows. Where managed, deploy the updates via MDM to enforce timely remediation.

Affected VersionsENISA

iOS and iPadOS 0 <26.5.2

macOS 0 <26.5.2

Safari 0 <26.5.2

Affected Packages

euvd ios_and_ipados fix: 26.5.2

euvd macos fix: 26.5.2

euvd safari fix: 26.5.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Technical ContextAI · show details

The vulnerability resides in WebKit's clipboard access handling, the engine shared across Safari, iOS/iPadOS, and macOS (per CPE strings cpe:2.3:a:apple:safari, cpe:2.3:a:apple:ios_and_ipados, and cpe:2.3:a:apple:macos). The root cause is classed as CWE-732 (Incorrect Permission Assignment for a Critical Resource): browser clipboard read APIs are normally gated behind user gesture or permission checks, but a state-management defect allowed a web page to bypass those checks and access clipboard data programmatically. Apple's advisory states the fix was 'addressed through improved state management,' indicating the permission/authorization state for clipboard reads was not reliably enforced across page interactions.

Know when Ios And Ipados gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apple) PRIMARY 6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI 7.5 HIGH

Remote malicious page needs no auth or user interaction (AV:N/AC:L/PR:N/UI:N); silent clipboard read discloses sensitive data (C:H) with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE HIGH

Red Hat 6.5 MEDIUM

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

6

Severity Changed

Jun 30, 2026 - 20:22 NVD

HIGH MEDIUM

CVSS changed

Jun 30, 2026 - 20:22 NVD

7.5 (HIGH) 6.5 (MEDIUM)

CVSS changed

Jun 30, 2026 - 13:22 NVD

7.5 (HIGH)

Patch available

Jun 29, 2026 - 22:02 EUVD

CVE Published

Jun 29, 2026 - 19:43 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 29, 2026 - 19:43 cve.org

HIGH 7.5

DescriptionCVE.org

This issue was addressed through improved state management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. A malicious website may be able to silently hijack clipboard data.

Executive ViewAI

Why It Matters

Apple disclosed a high-severity vulnerability in Safari and its WebKit engine that allows attackers to silently steal clipboard contents from Safari users across iOS, iPadOS, and macOS. While no public exploit has been identified to date, clipboard data frequently contains sensitive credentials and personal information, creating significant data exfiltration risk across the organization. Vendor patches are available and should be deployed immediately to prevent future exploitation.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 95% exploitable

Prevalence

Ubiquitous

Safari/WebKit is default browser engine across all Apple devices

Social Media

1

Sightings

Data Quality

7 sources

Confidence: High

EUVD

CVE.org

EPSS

Vulnrichment Vendor CIRCL

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Partial

Priority Score

32

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +32

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Ios And Ipados

View all

CVE-2026-86950 HIGH Act Now POC

Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe

CVE-2026-43723 HIGH This Week POC

Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,

CVE-2026-28952 HIGH This Week POC

Integer overflow in Apple operating systems allows remote unauthenticated attackers to crash devices via maliciously cra

CVE-2026-65414 CRITICAL Act Now

An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate

CVE-2026-64771 CRITICAL Act Now

Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause

CVE-2026-43803 CRITICAL Act Now

Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg

CVE-2026-43810 CRITICAL Act Now

Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.

CVE-2026-64770 CRITICAL Act Now

Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma

CVE-2026-64769 CRITICAL Act Now

Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a

CVE-2026-64774 CRITICAL Act Now

We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou

CVE-2026-64772 CRITICAL Act Now

Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an

CVE-2026-84561 CRITICAL Act Now

Kernel memory corruption in Apple's operating systems lets an app already running on a device trigger a double free (CWE

Same weakness CWE-732 – Incorrect Permission Assignment for Critical Resource

View all

CVE-2017-9462 HIGH POC

CVE-2017-3006 HIGH POC

CVE-2017-9602 CRITICAL POC

CVE-2022-22960 HIGH POC

CVE-2021-38085 HIGH POC

CVE-2021-35449 HIGH POC

CVE-2020-11855 HIGH POC

CVE-2020-10883 HIGH POC

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

CVE-2021-34523 CRITICAL POC

CVE-2013-2251 CRITICAL POC

CVE-2017-5638 CRITICAL POC

CVE-2025-24813 CRITICAL POC

CVE-2025-68613 HIGH POC

CVE-2015-1701 HIGH POC

CVE-2017-0147 HIGH POC

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Liberty Linux 8	Fixed
SUSE Liberty Linux 9	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS	Affected

References

Advisories & patches

ADVISORY https://access.redhat.com/errata/RHSA-2026:42062 ADVISORY https://access.redhat.com/errata/RHSA-2026:42088 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-43721 ADVISORY https://vuldb.com/vuln/374746 REF https://support.apple.com/en-us/127594 REF https://support.apple.com/en-us/127595 REF https://support.apple.com/en-us/127685 REF https://support.apple.com/en-us/128068 REF https://support.apple.com/en-us/128069 REF https://support.apple.com/en-us/128070

Search Externally

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy