Safari Web Content Processing Vulnerabilities

Arbitrary code execution in Apple Safari and WebKit-based components on iOS/iPadOS, macOS, and visionOS can occur when a user processes maliciously crafted web content, due to a type confusion flaw corrected with improved state management. Safari, iOS/iPadOS, macOS, and visionOS versions prior to 27 are affected, while Safari 27, iOS/iPadOS 27, macOS Golden Gate 27, and visionOS 27 contain the fix. The CVSS 3.1 score of 8.8 reflects a network-reachable, low-complexity, unauthenticated attack that requires user interaction (visiting hostile content); no public exploit was identified at time of analysis.

A type-confusion logic flaw (CWE-843) in Apple's WebKit rendering engine can be triggered when a user loads maliciously crafted web content, causing unexpected behavior with limited confidentiality and availability impact. The bug affects Safari, visionOS, and watchOS builds prior to version 27 on all platforms, and is fixed by the vendor's 27-series releases; exploitation requires the victim to render an attacker-controlled page (UI:R) but no credentials (PR:N). Risk is moderate and low-urgency: EPSS is 0.16% (5th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis, and impact is capped at low confidentiality/availability with no integrity effect or confirmed reliable code execution.