Apple Safari EUVD-2026-77932

Exploitation requires the victim to open an attacker-crafted .webarchive file (Apple's Safari web-archive format) in an unpatched Safari/WebKit context on iOS/iPadOS/macOS/visionOS below version 27. It is a UXSS that abuses a logic/state-management flaw in webarchive handling; there are no authentication prerequisites (PR:N), but user interaction is mandatory (UI:R) - the file must be delivered (email, download, share) and manually opened, and it is not triggered automatically from an ordinary web page, which materially limits drive-by mass exploitation. Limiting factors: required user interaction, the niche webarchive delivery vector, and the need for the target to run a pre-27 Apple OS/Safari build.

Signals are mixed but lean toward moderate-but-notable risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N = 5.4) rates this Medium, but I assess the vendor's scoring as UNDERSTATED: this is a universal cross-site scripting (UXSS) flaw, which by definition breaks the same-origin policy and lets injected script run in the context of arbitrary web origins - that is a security-scope change (S:C) with higher confidentiality/integrity impact than the C:L/I:L assigned. EPSS is very low (0.15%, 4th percentile) and there is no CISA KEV listing and no public POC, so exploitation is neither confirmed nor probable in the near term. The mitigating factor is delivery friction: the victim must obtain and open a malicious .webarchive file (UI:R), and webarchive is a niche Apple-specific format not auto-rendered from arbitrary web pages, which sharply limits mass, drive-by exploitation. Net: a real correctness/security defect worth patching on Apple's normal cadence, but not an emergency - the low EPSS and required user interaction argue against imminent widespread abuse, while the UBIQUITOUS install base of Apple browsers means residual exposure is broad if a weaponized lure ever emerges. Note the CVSS says AV:N yet exploitation hinges on opening a locally-delivered file - treat the 'network' vector as reachability of the malicious file, not a pure remote drive-by.

An attacker crafts a malicious .webarchive file and delivers it via phishing email, a download link, or a shared document, luring the victim to open it in Safari on an unpatched Apple device. On open, the embedded content triggers the state-management logic flaw and executes attacker-controlled JavaScript in the context of other web origins (UXSS), enabling theft of session data or actions against sites the victim is logged into. No public exploit code or active exploitation has been identified at time of analysis.