Apple
Monthly
Denial-of-service in multiple Apple operating systems allows a local network attacker to cause resource exhaustion and system unavailability. The vulnerability is addressed in iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. No public exploit or active exploitation has been identified at this time, and the EPSS score is low (0.17%).
Authentication bypass via lock screen in macOS allows a person with physical access to view contacts and photos on a locked device. The issue affects macOS prior to Sequoia 15.7.8 and Tahoe 26.6. No active exploitation or public exploit code is reported, but the vulnerability bypasses a fundamental security boundary.
Bypass of iframe sandboxing policy in Apple Safari and all Apple operating systems through version 26.5 allows malicious web content to violate sandbox restrictions. Affected users include anyone running Safari on iOS, iPadOS, macOS Tahoe, tvOS, visionOS, or watchOS prior to version 26.6. An attacker can cause integrity violations, such as injecting or modifying content within sandboxed iframes, but requires user interaction (clicking a link or visiting a malicious page) and no public exploit or active exploitation has been identified at this time.
A malicious app can access sensitive user
Sensitive user data exposure in macOS allows a malicious app to read private information by bypassing access controls. Affected versions are prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No public exploit or active exploitation has been identified; EPSS score of 0.16% indicates a very low probability of widespread attacks.
iOS and iPadOS versions before 26.6 allow a malicious app to modify protected file system areas via a race condition. The vulnerability, tracked as CVE-2026-43811, requires local user interaction and has no known public exploit or active exploitation, with EPSS indicating very low real-world likelihood.
Information disclosure in macOS asset catalog processing allows local attackers to read process memory by enticing a user to open a malicious asset catalog. Affected versions prior to macOS Sequoia 15.7.8 and Sonoma 14.8.8 are vulnerable. No active exploitation or public exploit code exists; EPSS indicates low exploitation probability.
An inconsistent user interface state management in multiple Apple operating systems allows remote attackers to bypass network filters, potentially leading to unauthorized actions on the system. The vulnerability requires user interaction (e.g., clicking a link) and affects iOS and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. No active exploitation has been reported at this time, and the EPSS score (0.27%, 20th percentile) indicates a low immediate threat.
Protected user data exposure in Apple operating systems allows a malicious app with on-device access to read sensitive information through insufficient input sanitization. This CVE-2026-43714 affects iOS and iPadOS before 26.6, macOS Sequoia before 15.7.8, Sonoma before 14.8.8, Tahoe before 26.6, visionOS before 26.6, and watchOS before 26.6. No public exploit has been identified and the low EPSS score
An authorization bypass vulnerability in Apple macOS allows a local application to access sensitive user data without proper authorization. This issue is fixed in macOS Sequoia 15.7.8 and macOS Tahoe 26.6. No active exploitation (not in CISA KEV) or public proof-of-concept has been identified, and EPSS scores the exploitation probability as low (0.15%).
Denial-of-service via type confusion in Apple ImageIO affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Processing a maliciously crafted image can crash an application, with no code execution. No active exploitation or public exploit is known; EPSS 0.17% indicates low likelihood of widespread attacks.
Sandbox escape in macOS allows a malicious app to read files outside its sandbox. Affects macOS Sonoma prior to 14.8.8, Sequoia prior to 15.7.8, and Tahoe prior to 26.6. No active exploitation or public exploit
Cleartext transmission of sensitive data in Apple iOS 26.6 and earlier allows an app to access sensitive user data over the network. The issue is fixed by enforcing HTTPS in iOS and iPadOS 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. No public exploit has been identified and EPSS risk is low (0.16%).
Local information disclosure in macOS Tahoe and watchOS allows an installed app to access sensitive user data without proper authorization. The vulnerability requires user interaction and is fixed in macOS Tahoe 26.6 and watchOS 26.6. No active exploitation or public exploit has been reported, and EPSS probability is low at 0.15%.
We are tasked with synthesizing data from multiple intelligence sources about CVE-2026-64754 into a comprehensive analysis, returning a JSON object with specific fields. All fields must be plain text strings (paragraphs). We must use all provided data and cross-reference to add value. The output must be grounded in the input data, not invented. Let's extract and analyze the provided data: - CVE ID: CVE-2026-64754 - Description: "An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to a denial-of-service." - CVSS Score: 5.5, Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CWE: CWE-787 (Out-of-bounds Write) - EPSS: 0.16% (percentile 5%) — low exploitation probability. - Patch: Available from vendor (Yes). The fix is listed in the versions above. - Reported by: apple - CPE: apple:ios_and_ipados, apple:macos, apple:tvos, apple:visionos, apple:watchos — all with *:*:*:*:*:*:*. Specific version ranges given by EUVD: macOS 0 <15.7.8, macOS 0 <14.8.8, iOS and iPadOS 0 <26.6, macOS 0 <26.6, watchOS 0 <26.6, tvOS 0 <26.6, visionOS 0 <26.6. Note the macOS versions include Sequoia 15.7.8 fix, Sonoma 14.8.8, Tahoe 26.6. "macOS 0 <26.6" likely means macOS Tahoe (version 26.x). So affected products: all Apple operating systems before these fixed versions. - Tags: Apple, Buffer Overflow, Ios And Ipados, Tvos, Visionos, Watchos, Memory Corruption. Also "Memory Corruption" tag is relevant. - References: All are Apple support pages: 128066, 128067, 128068, 128069, 128070, 128071, 128072. Also ENISA EUVD ID: EUVD-2026-49465, with link to NVD. Now, we need to produce each field as a paragraph. 1. product_name: "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'. NOT
Information disclosure in iOS and iPadOS versions before 26.6 allows a locally installed malicious application to access sensitive user data without proper authorization. Apple addressed the flaw in iOS 26.6 and iPadOS 26.6 with improved state management; no active exploitation or public proof-of-concept has been identified. The EPSS exploitation probability is low (0.14%), consistent with the local attack vector and required user interaction.
Sensitive user data can be accessed by unauthorized apps on macOS and watchOS due to an authorization flaw in state management. Apple released patches in macOS Sequoia 15.7.8, Sonoma 14.8.8, Tahoe 26.6, and watchOS 26.6. No public exploit or active exploitation is known; EPSS indicates a low likelihood of exploitation.
An authorization bypass in Apple iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS versions before 26.6 allows an app to access sensitive user data without proper permission. The vulnerability requires user interaction (opening a malicious app) and has not been actively exploited, with no CISA KEV listing and a low EPSS probability of 0.16%.
Out-of-bounds read in Apple macOS allows a local app to access sensitive user data. The vulnerability (CWE-787) has been patched in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. Exploitation requires user interaction (opening a malicious app or file), and no public exploits are known to be in the wild.
Sensitive kernel state leak in macOS allows a local application to read kernel memory. Apple fixed this in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 by improving redaction. The vulnerability has low exploitation probability (EPSS 0.16%) and is not known to be actively exploited.
Unexpected Safari crash via use-after-free when processing maliciously crafted web content affects Safari 26.6 and earlier on all Apple platforms. This denial-of-service condition requires user interaction to open a malicious webpage; no public exploit identified and EPSS probability is low (0.14%).
Information disclosure in Apple Contacts across iOS, iPadOS, macOS, visionOS, and watchOS allows a local attacker to leak sensitive data by processing a maliciously crafted contact. Apple has released patches in iOS 26.6 and other updates. No public exploit is identified, and EPSS indicates
Sensitive information disclosure vulnerability in macOS via a race condition allows a local malicious application to access user data. Apple fixed the issue in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No active exploitation or public proof-of-concept is known.
Denial of service in macOS Tahoe fixed by removing vulnerable code. A local attacker with low privileges can cause a denial-of-service condition. No active exploitation or public exploit known, and the low EPSS score (0.14%) indicates limited real-world risk.
Denial of service in Apple operating systems via out-of-bounds write allows a local app to cause unexpected system termination. Affected versions include iOS/iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS prior to 26.6. No active exploitation has been reported, EPSS risk is low at 0.16%, and no public exploit code identified at time of analysis.
A buffer overflow in the processing of 3D models on Apple iOS, iPadOS, and macOS leads to disclosure of process memory. Affected versions include iOS/iPadOS prior to 26.6 and macOS prior to Sequoia 15.7.8 and Tahoe 26.6. An attacker who can deliver a malicious 3D model to a victim could leak sensitive information; no active exploitation or public exploit has been reported, and the EPSS probability is low (0.18%).
Information disclosure in Apple iOS, iPadOS, and macOS Tahoe allows a malicious app with local access to read a user's contacts database. The flaw is fixed in iOS 26.6, iPadOS 26.6, and macOS Tahoe 26.6. No public exploit or active exploitation has been reported, and the EPSS score (0.15%) indicates low exploitation likelihood.
In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire: isight: bound the sample count to the packet payload isight_packet() takes the frame count from the device iso packet and checks it only against the device claimed iso length. count = be32_to_cpu(payload->sample_count); if (likely(count <= (length - 16) / 4)) isight_samples(isight, payload->samples, count); length is the iso header data_length. It can be up to 0xffff. So the gate allows a count up to about 16379. isight_samples() then copies count frames out of payload->samples into the PCM DMA buffer. payload->samples holds only 2 * MAX_FRAMES_PER_PACKET values. The device multiplexes two samples per frame. A count past MAX_FRAMES_PER_PACKET reads past the payload. A count past the buffer size writes past runtime->dma_area. The smallest PCM buffer is larger than MAX_FRAMES_PER_PACKET. Bounding the count to MAX_FRAMES_PER_PACKET keeps both the read and the write in range. A malicious or faulty Apple iSight on the FireWire bus reaches this during a normal capture. Add the MAX_FRAMES_PER_PACKET bound to the gate.
HTTP request smuggling in SwiftNIO HTTP/2 allows unauthenticated remote attackers to inject headers or split responses via crafted HTTP/2 HEADERS frames that pass control characters through the HTTP/2-to-HTTP/1.1 codec. The vulnerability, caused by missing CR/LF/NUL/SP validation in regular header values and pseudo-headers, can be exploited when outbound validation is disabled or headers are forwarded without rechecking. Fixed in version 1.45.0; no public exploit identified at time of analysis and EPSS score is 0.14% (low).
Uncontrolled resource consumption in dompdf's BMP image processing pipeline allows any unauthenticated attacker who can submit HTML to a dompdf-powered endpoint to exhaust server memory and stall PHP-FPM worker pools with a 169-byte HTTP request. The library trusts attacker-controlled BMP header dimensions without bounding width × height, causing PHP's GD extension to allocate a full native pixel canvas - bypassing PHP's memory_limit entirely because GD allocates through its own native allocator. A publicly available, verified proof-of-concept demonstrates ~12× memory amplification (34 MB control vs ~412 MB attack peak RSS) from identically-sized requests, making this a high-impact, low-effort denial-of-service primitive. No active exploitation confirmed in CISA KEV at time of analysis.
Shell sandbox bypass in the optional @n8n/computer-use package for n8n exposes the full host filesystem and network to any privileged user who can invoke a computer-use workflow on Linux or Windows, because sandboxing was only implemented for macOS. Affected are n8n versions before 2.29.8 and 2.30.x before 2.30.1; standard n8n installations without the @n8n/computer-use package are entirely unaffected. No public exploit has been identified at time of analysis, but the subsequent-system impact is rated High across confidentiality, integrity, and availability in the vendor-sourced CVSS 4.0 vector.
Draft release attachment disclosure in Gitea exposes files uploaded to draft releases to unauthenticated network callers via UUID-based web endpoints, bypassing access controls that correctly gate the parallel API handlers. This is an incomplete fix for CVE-2026-27660: that advisory's PR #36659 added `canAccessReleaseDraft` checks to every API code path but left the web-side `ServeAttachment` handler ungated, allowing anyone who obtains an attachment UUID to download its contents with no authentication. A working proof-of-concept is documented in the advisory and confirmed against Gitea v1.27.0+dev; no public exploit identified at time of analysis beyond the advisory PoC, and the vulnerability does not appear in CISA KEV.
Apple's Find My backend service allows an attacker who holds a valid PET (Private Endpoint Token) to enumerate devices on an Apple ID account and silently remove offline devices without triggering two-factor authentication or ownership verification - a CWE-287 Improper Authentication flaw. The vulnerability affects the service through at least December 17, 2025, with researcher-published proof-of-concept code on GitHub demonstrating the technique. EPSS sits at 0.19% (9th percentile) and the vulnerability is not listed in CISA KEV, pointing toward targeted rather than opportunistic exploitation; however, the account-manipulation impact makes it meaningful for high-value Apple ID targets.
Policy signing key bypass in ClearanceKit prior to 5.0.10 permits any root process on macOS to forge valid signatures over arbitrary policy database content, granting full control over ClearanceKit's per-process file-system access enforcement plane. The root cause is a silent ACL failure specific to the macOS legacy System Keychain: ECDSA key items persisted via SecItemAdd silently lose their kSecAttrAccess restriction, leaving the signing key unrestricted to any root caller. No public exploit has been identified and no CISA KEV listing exists, but the integrity impact extends beyond the vulnerable component to the entire policy enforcement layer ClearanceKit provides.
ClearanceKit's on-disk SQLite policy store on macOS is vulnerable to a replay attack that allows a high-privileged local attacker to substitute a previously-captured, legitimately-signed policy snapshot, causing the opfilter component to enforce outdated or permissive per-process file-access policies on the next boot. All releases prior to version 5.0.10 are affected, with exploitation gated to specific windows: the opfilter-update period when the Endpoint Security filter is offline, offline-boot scenarios, or decrypted-backup restoration. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS data was not provided in available intelligence.
Cyrus IMAP through version 3.12.2 contains an authorization flaw in its XAPPLEPUSHSERVICE (XAPS) command that lets authenticated IMAP users enumerate arbitrary mailboxes belonging to other accounts and redirect Apple Push Notification Service alerts about those mailboxes to their own device. The flaw (CWE-863, Incorrect Authorization) does not expose message content - only whether a target mailbox exists and when its modification sequence (modseq) changes - but it enables cross-account probing and unauthorized push subscription in multi-tenant IMAP deployments. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; the low CVSS score of 3.1 is consistent with the limited confidentiality impact and mandatory authentication requirement.
Drive-by local filesystem exfiltration in FiftyOne versions below 1.17.0 allows any malicious website to silently read arbitrary files from a victim's machine. The FiftyOne App server unconditionally returns Access-Control-Allow-Origin: * on all responses, and the unauthenticated /media endpoint serves local filesystem files by path - together these let JavaScript on any visited webpage fetch files such as SSH keys, cloud credentials, or .env files from localhost:5151 and relay them to an attacker-controlled server. No public exploit (KEV or confirmed POC) is identified at time of analysis, but the attack requires no special tooling and is trivially reproducible in Safari and Firefox, which lack Private Network Access protections.
Unbounded goroutine accumulation in Hoverfly v1.12.7 and earlier allows remote denial of service via its remote post-serve action feature. The unauthenticated admin API permits any network-reachable attacker to register a post-serve action pointing at a black-hole TCP endpoint, load a catch-all simulation, then flood the proxy port - each matching request spawns a goroutine that blocks indefinitely in `http.DefaultClient.Do()`, consuming approximately 66 KB each until the process is OOM-killed. A detailed proof-of-concept with verified memory measurements is publicly available in GitHub Security Advisory GHSA-42j2-w334-qxw7; no CISA KEV listing has been recorded at time of analysis.
PDF save functionality in Firefox for iOS allows maliciously crafted page titles to manipulate the output file path, enabling overwrites of existing PDF files or bundled application content within the Firefox iOS sandbox. All versions prior to 152.4 on Apple iOS devices are affected. An attacker operating a malicious website can lure a user into saving a page as PDF, causing the crafted title to resolve to an unintended file path within the app sandbox - potentially corrupting application state or stored documents. No public exploit has been identified at time of analysis, though SSVC classifies the vulnerability as automatable with partial technical impact.
Open redirect bypass in openrun prior to v0.17.7 allows remote unauthenticated attackers to redirect victims to arbitrary external URLs by exploiting a double-slash path prefix that evades the application's host/scheme validation. The referrer-based redirect logic correctly validates the host and scheme but passes the extracted path `//attacker.com` to the Location header, which browsers interpret as a protocol-relative URL and resolve to an external destination. A proof-of-concept is publicly documented in the security advisory; no active exploitation has been confirmed by CISA KEV at time of analysis.
Privilege escalation in Palo Alto Networks Prisma® Browser on macOS enables a locally authenticated administrator with access to the local filesystem to perform actions at root privilege level. The vulnerability is scoped exclusively to macOS deployments of Prisma Browser - no other platforms or Palo Alto products are implicated per the advisory. No public exploit identified at time of analysis; the CVSS 4.0 base score of 2.0 reflects the substantial exploitation prerequisites that materially constrain real-world risk despite the full-system impact potential at root level.
Improper certificate validation in the Palo Alto Networks Prisma Access Agent for iOS exposes VPN tunnel traffic to interception and manipulation by a network-adjacent attacker. The flaw (CWE-295) enables a man-in-the-middle position to defeat the agent's TLS/certificate trust chain, allowing an adversary to read or alter traffic that the iOS client believes is securely tunneled. Exploitation is limited to iOS deployments - the Windows, macOS, Linux, Android, and ChromeOS agents are confirmed unaffected. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog.
Multiple protection mechanism failures in the Data Loss Prevention (DLP) component of Palo Alto Networks Prisma Access Agent for Windows enable a local authenticated user to bypass DLP policy enforcement controls. Only the Windows platform is affected; the Prisma Access Agent for macOS is explicitly excluded per vendor advisory. No public exploit code or active exploitation has been identified at time of analysis, though the CVSS 4.0 supplemental urgency rating of Amber and high confidentiality/integrity impact on the vulnerable system make this a meaningful insider threat risk.
Setuptools prior to 83.0.0 fails to normalize Unicode filenames before matching them against MANIFEST.in exclusion patterns on macOS APFS and HFS+ filesystems, allowing files with NFD-normalized on-disk names to silently bypass NFC-encoded exclude, global-exclude, recursive-exclude, and prune directives and be packed into Python source distributions. Python package maintainers developing on macOS face a supply chain risk: sensitive files such as credentials, private keys, or environment configs that are correctly listed in MANIFEST.in for exclusion may still appear in tarballs published to PyPI or private registries. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Address bar spoofing in Firefox for iOS allows a remote unauthenticated attacker to display a trusted origin in the browser's address bar while the victim views and interacts with fully attacker-controlled content - a classic and effective phishing enabler. The attack exploits a race condition in navigation handling: a malicious page enqueues a synchronous JavaScript dialog at the moment a user navigates away, freezing the address bar on the destination's legitimate origin while the malicious page's content continues to render. No public exploit code has been identified and EPSS is 0.15% (4th percentile), indicating no observed widespread exploitation; however, the technique is conceptually simple and phishing value is high.
Remote image auto-fetch in the OpenAI Codex desktop app for macOS (versions prior to 26.527.31326) enables silent exfiltration of session secrets via indirect prompt injection. An attacker who can place malicious instructions into content processed by Codex - such as a tool result, API response, or file read during a session - can manipulate the model into generating a Markdown image tag whose URL encodes sensitive data; the app then automatically fetches that URL, transmitting API keys, source code, or tool-returned data to an attacker-controlled server with no additional user action. No active exploitation is confirmed (not listed in CISA KEV), no public proof-of-concept is identified, and EPSS sits at 0.16% (6th percentile), indicating low current exploitation probability despite the high-value target profile of affected users.
OS command injection in create-react-app's react-dev-utils component enables remote code execution on macOS developer workstations running version 5.0.1 or earlier. The vulnerability resides in the startBrowserProcess function of openBrowser.js, which processes unsanitized input that reaches a shell invocation. A publicly available proof-of-concept exploit exists via the project's GitHub issue tracker; no vendor patch has been released and the maintainers have not responded to disclosure, leaving the entire supported version history of this widely-used but now-archived tool permanently unpatched.
Local privilege escalation in Cato Client on macOS allows an authenticated low-privileged user to gain root by chaining two flaws in the PrivilegedHelperTool XPC service: improper certificate validation (CWE-295) that accepts self-signed certificates to bypass XPC caller verification, and a TOCTOU race condition exploitable via symlink swap during package installation. All Cato Client (SDP Client) versions prior to 5.13.1 on macOS are affected. A proof-of-concept exists per the CVSS 4.0 supplemental metric E:P, and the AU:Y (Automatable) tag indicates the exploit chain can be scripted - elevating practical urgency despite the absence of a CISA KEV listing.
UI spoofing in Google Chrome's Passwords feature on iOS (versions prior to 150.0.7871.47) enables remote attackers to manipulate the presentation of security-critical password UI elements via a specially crafted HTML page. Users who visit a malicious page in Chrome on iOS may see misleading security indicators or spoofed password dialogs, potentially deceiving them into unintended credential interactions. No public exploit identified at time of analysis; EPSS is 0.18% (8th percentile), and SSVC confirms no observed exploitation - risk is real but low-priority relative to the broader threat landscape.
UI spoofing in Google Chrome for iOS prior to 150.0.7871.47 allows a remote attacker to manipulate browser interface elements via a crafted HTML page, provided the attacker can lure the victim into performing specific UI gestures. The root cause is insufficient validation of untrusted HTML input (CWE-20) within Chrome's iOS-specific rendering layer, resulting in low-integrity and low-availability impact. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog; Chromium's own severity classification is Low.
UI spoofing in Google Chrome for iOS prior to 150.0.7871.47 allows a remote, unauthenticated attacker to misrepresent browser interface elements by delivering a crafted HTML page to a victim who visits it. Rooted in CWE-451 (UI Misrepresentation of Critical Information), the flaw arises from insufficient validation of untrusted HTML input in the iOS-specific Chrome rendering pipeline, enabling manipulation of trust signals such as address bar display or security indicators. No public exploit identified at time of analysis; EPSS at 0.18% (8th percentile) and SSVC Exploitation: none confirm negligible current threat actor interest.
Omnibox spoofing in Google Chrome for iOS prior to 150.0.7871.47 enables remote attackers to display false URL content in the browser's address bar by luring a user to a crafted HTML page, creating a credible phishing vector. The flaw stems from inappropriate implementation in the iOS-specific Omnibox rendering logic (CWE-451), distinct from Chrome's desktop codebase. No public exploit code has been identified and EPSS sits at 0.18% (8th percentile), indicating negligible opportunistic exploitation probability at this time.
Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 150.0.7871.47 allows a remote attacker to display a fraudulent URL in the browser's address bar by delivering a crafted HTML page. The root cause is classified as CWE-451 (UI Misrepresentation of Critical Information), meaning the security UI fails to accurately reflect the true origin of displayed content - a condition that directly undermines phishing defenses. No public exploit code has been identified at time of analysis, and the EPSS score of 0.18% (8th percentile) indicates very low observed exploitation pressure, consistent with the Chromium team's own 'Low' severity rating.
No-referrer policy bypass in Google Chrome for iOS prior to 150.0.7871.47 allows a remote attacker to capture referrer URL information that the browser was supposed to suppress. Exploitation requires user interaction - the victim must visit a crafted HTML page served by the attacker - and exploits a client-side enforcement gap (CWE-602) specific to the iOS build of Chrome. EPSS is 0.19% (9th percentile) and no active exploitation or KEV listing exists, consistent with the Low Chromium severity rating.
Side-channel information leakage in the WebAuthentication component of Google Chrome on iOS (prior to 150.0.7871.47) exposes cross-origin data to remote attackers via a crafted HTML page, requiring only that a victim visit attacker-controlled content. The CVSS Confidentiality:High rating reflects the category of cross-origin data exposure, while Chromium's own internal severity classification of Low and an EPSS score of 0.21% (11th percentile) both signal that practical exploitation is considered unlikely at scale. No public exploit is identified at time of analysis and no CISA KEV listing exists.
Universal Cross-Site Scripting (UXSS) in Chrome's Omnibox on iOS enables remote attackers to inject arbitrary scripts or HTML across security origins by luring users into performing specific UI gestures on a crafted page. Affected versions are Chrome for iOS prior to 150.0.7871.47; the desktop channel is not affected. No public exploit code or active exploitation has been identified at time of analysis, and EPSS sits at 0.18% (8th percentile), consistent with Chromium's own 'Low' severity rating despite the scope-changed CVSS vector.
Navigation restriction bypass in Google Chrome for iOS prior to 150.0.7871.47 allows a remote, unauthenticated attacker to circumvent browser-enforced navigation controls by delivering a crafted HTML page. The flaw is confined to the iOS platform - Chrome on Android, Windows, macOS, and Linux is unaffected - and requires the victim to actively visit the attacker-controlled page (UI:R). With a CVSS score of 4.3 (Medium), an EPSS of 0.19% (9th percentile), no CISA KEV listing, and a Chromium-internal severity rating of Low, this vulnerability carries minimal real-world exploitation risk but warrants patching given its zero-privilege attack vector.
UI spoofing in Google Chrome for iOS prior to 150.0.7871.47 allows a remote attacker to misrepresent security indicators to users who are socially engineered into performing specific UI gestures on a crafted HTML page. The root cause is incorrect rendering of security UI elements (CWE-451), classified by the Chromium team as Low severity. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog, aligning with the modest CVSS 4.2 score and the high-complexity attack requirements.
UI spoofing in Google Chrome for iOS prior to version 150.0.7871.47 enables remote attackers to manipulate browser interface elements through a specially crafted HTML page, potentially deceiving users into believing they are interacting with a trusted site. The flaw arises from insufficient validation of untrusted input (CWE-20) in the iOS-specific Chrome layer and requires user interaction - a victim must navigate to a malicious page. No public exploit exists, CISA has not listed this in KEV, and an EPSS score of 0.17% (7th percentile) confirms very low real-world exploitation probability at the time of analysis.
Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 150.0.7871.47 enables a remote attacker to display falsified URL content to a victim user via a crafted HTML page. Exploitation requires convincing the target to perform specific UI gestures while visiting the malicious page, making this a phishing-enabler rather than a direct code-execution primitive. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; Google has released a fix in the 150.0.7871.47 stable channel update.
UI spoofing in Google Chrome for iOS prior to version 150.0.7871.47 enables a remote attacker to misrepresent page identity or security state through a specially crafted HTML page, exploiting an inappropriate implementation classified under CWE-451. The vulnerability affects only the iOS-specific Chrome codebase - not Chrome on other platforms - and requires user interaction (visiting an attacker-controlled page). No public exploit code has been identified and EPSS sits at 0.21% (11th percentile), indicating low observed exploitation probability; it is not listed in the CISA KEV catalog.
UI spoofing in Google Chrome for iOS prior to 150.0.7871.47 enables a remote unauthenticated attacker to misrepresent browser interface elements - such as the address bar or security indicators - through a specially crafted HTML page, potentially deceiving users about the origin or trustworthiness of web content. The CVSS vector (PR:N, UI:R) confirms no authentication is required but user interaction is necessary, and the SSVC framework rates exploitation as 'none' with partial technical impact. EPSS at 0.21% (11th percentile) and the absence of any KEV listing or public exploit code indicate no public exploitation activity at time of analysis.
Cross-origin data leakage in Google Chrome on iOS (prior to 150.0.7871.47) stems from an inappropriate implementation in the ScriptInjections subsystem, exploitable by a remote attacker who can lure a victim to a crafted HTML page. The flaw allows the attacker's origin to read data belonging to a different, protected origin - a fundamental violation of the Same-Origin Policy on Apple's iOS platform. No public exploit code has been identified at time of analysis, EPSS places exploitation probability at 0.22% (13th percentile), and SSVC signals no observed active exploitation, making this a medium-priority patch item despite its cross-origin impact.
Navigation restriction bypass in Google Chrome for iOS (prior to 150.0.7871.47) allows a remote attacker to subvert browser-enforced navigation controls by luring a user into performing specific UI gestures on a crafted HTML page. Classified as CWE-20 (Improper Input Validation), the flaw undermines integrity by permitting unauthorized navigation that the browser is intended to block. No public exploit code exists and EPSS sits at 0.22% (13th percentile), indicating low observed exploitation probability; the vulnerability is not listed in CISA KEV.
UI spoofing in Google Chrome for iOS prior to version 150.0.7871.47 allows a remote attacker to misrepresent browser interface elements - such as the address bar or origin indicators - by serving a crafted HTML page, potentially deceiving users into trusting malicious content. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms network-reachable exploitation with no privilege requirement but mandatory user interaction, limiting impact to partial integrity loss with no confidentiality or availability effect. No public exploit or active exploitation has been identified; an EPSS score of 0.21% at the 11th percentile indicates very low current exploitation probability, and this vulnerability does not appear in the CISA KEV catalog.
Cross-origin data leakage in Google Chrome's Autofill subsystem on iOS (versions prior to 150.0.7871.47) enables remote attackers to read sensitive data across origin boundaries by luring victims into performing specific UI gestures on a crafted page. Rooted in CWE-346 (Origin Validation Error), the Autofill policy enforcement layer fails to maintain proper origin isolation under targeted interaction conditions. With an EPSS of 0.21% (11th percentile) and no CISA KEV listing, no public exploit identified at time of analysis, though the CVSS-rated High confidentiality impact warrants prompt patching given Chrome's broad iOS deployment footprint.
UI spoofing in Google Chrome's Safe Browsing component on iOS enables remote attackers to mislead users through a crafted HTML page, potentially causing them to dismiss or misinterpret security warnings. Only Chrome for iOS versions prior to 150.0.7871.47 are affected; the desktop channel is not impacted by this specific flaw. No public exploit code exists and exploitation probability is very low (EPSS 0.21%, 11th percentile), though the network-accessible, zero-authentication attack surface keeps it relevant where phishing-style delivery is feasible.
Navigation restriction bypass in Google Chrome's Omnibox on iOS (prior to 150.0.7871.47) enables a remote attacker to circumvent address bar security controls through insufficient input validation, contingent on user interaction with specific UI gestures during exposure to malicious network traffic. The integrity impact is rated High (I:H) with no confidentiality or availability impact, consistent with a content/navigation spoofing class of vulnerability. No public exploit code or CISA KEV listing has been identified; EPSS score of 0.20% (10th percentile) indicates low observed exploitation probability at time of analysis.
UI spoofing in Google Chrome's iOSWeb component on iOS allows remote attackers to misrepresent interface elements to users running versions prior to 150.0.7871.47. The vulnerability, rooted in an inappropriate implementation (CWE-451), is triggered when a user performs specific UI gestures on a crafted HTML page, enabling spoofing of security-critical browser interface elements such as the address bar or permission dialogs. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the high attack complexity and mandatory user interaction meaningfully constrain real-world risk.
Race condition exploitation in Google Chrome for iOS (prior to 150.0.7871.47) exposes potentially sensitive data from process memory to a local attacker with physical device access. The flaw is rooted in improper synchronization (CWE-362) and requires high attack complexity to successfully win the timing window. No public exploit has been identified and the vulnerability is not listed in CISA KEV; the vendor has released a patching fix in the 150.0.7871.47 stable channel update.
Navigation restriction bypass in Google Chrome's Safe Browsing implementation on iOS allows a remote, unauthenticated attacker to circumvent phishing and malicious-site protections via a specially crafted HTML page, affecting all Chrome for iOS versions prior to 150.0.7871.47. The flaw is classified as CWE-693 (Protection Mechanism Failure), meaning the Safe Browsing guard can be rendered ineffective rather than defeated through cryptographic or authentication means. No public exploit or CISA KEV listing has been identified, and the EPSS score of 0.23% (14th percentile) signals low current exploitation probability - but the zero-prerequisite network delivery and high integrity impact make this a meaningful risk for iOS users who have not updated.
UI spoofing in Google Chrome for iOS prior to version 150.0.7871.47 enables remote attackers to misrepresent browser interface elements - such as address bars or security indicators - by delivering a crafted HTML page to a victim on an iOS device. Rooted in CWE-451 (UI Misrepresentation of Critical Information), the flaw exploits an inappropriate implementation specific to Chrome's iOS code path, which differs from desktop Chrome due to WKWebView constraints imposed by Apple. No public exploit code exists, CISA SSVC rates exploitation as none, and EPSS sits at the 12th percentile, indicating minimal real-world threat at time of analysis.
Cross-origin data leakage in Google Chrome for iOS prior to 150.0.7871.47 exposes sensitive information from other origins when a remote attacker convinces a victim to perform specific UI gestures on a crafted HTML page. The flaw stems from an inappropriate implementation in the iOS-specific Chrome browser layer, classified under CWE-451 (UI Misrepresentation), and enables confidentiality compromise without requiring attacker privileges. No public exploit code has been identified at time of analysis, and EPSS at 0.22% (12th percentile) signals low near-term automated exploitation risk.
Side-channel information leakage in WebAuthentication within Google Chrome on iOS (versions prior to 150.0.7871.47) enables a remote attacker to infer cross-origin data by directing a victim to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms network-exploitable impact with high confidentiality loss, constrained by mandatory user interaction and scoped exclusively to the iOS platform. No public exploit identified at time of analysis; EPSS at 0.25% (16th percentile) signals low near-term exploitation probability, and no CISA KEV listing is present.
Insufficient Web Authentication (WebAuthn/Passkeys) policy enforcement in Google Chrome on iOS prior to 150.0.7871.47 enables cross-origin data leakage to an attacker controlling a privileged network position. The flaw stems from CWE-693 (Protection Mechanism Failure) in the browser's WebAuthn subsystem, which fails to enforce origin isolation correctly when processing crafted HTML pages. No public exploit code exists and CISA has not listed this in KEV, but the high confidentiality impact (C:H) and the specificity of Chrome-on-iOS as the attack surface make this a targeted patching priority for organizations with a managed iOS fleet.
Cross-origin data leakage in Google Chrome for iOS prior to 150.0.7871.47 enables remote attackers to exfiltrate sensitive information from other origins by luring victims to a crafted HTML page that exploits insufficient input validation. The vulnerability carries a CVSS 6.5 with high confidentiality impact (AV:N/PR:N/C:H) but requires user interaction and is iOS-platform-specific, constraining the realistic attack surface. No public exploit or active exploitation has been identified at time of analysis; EPSS is 0.22% at the 12th percentile and SSVC rates exploitation as none.
Omnibox spoofing in Google Chrome for iOS prior to 150.0.7871.47 enables remote unauthenticated attackers to display a falsified URL in the browser address bar by delivering a crafted HTML page to an iOS user. The flaw is classified CWE-451 (UI misrepresentation of critical information) and is iOS-platform-specific, with no impact on Chrome for Android, Windows, macOS, or Linux. No active exploitation is confirmed - the vulnerability is not listed in CISA KEV and EPSS sits at 0.22% (12th percentile) - but the spoofing primitive is a classic enabler of targeted phishing campaigns against mobile users.
Universal Cross-Site Scripting (UXSS) in Google Chrome for iOS prior to 150.0.7871.47 enables a remote attacker to inject arbitrary scripts or HTML across origins by exploiting insufficient input validation triggered through specific user UI gestures on a crafted page. The scope change (S:C in CVSS) is the critical dimension here - successful exploitation bypasses the same-origin policy, potentially granting the attacker script execution in the context of arbitrary origins within the browser session. No public exploit code has been identified and EPSS sits at just 0.20% (11th percentile), indicating low observed exploitation activity despite the high-impact class of vulnerability.
Cross-origin data leakage via side-channel in Google Chrome's Safe Browsing component on iOS affects all Chrome versions prior to 150.0.7871.47, exploitable only by an attacker who has already compromised the renderer process. The vulnerability (CWE-1300) allows confidentiality impact through a crafted HTML page that abuses Safe Browsing timing or state signals to exfiltrate data across origin boundaries. No public exploit code exists at time of analysis, SSVC records exploitation as none, and EPSS probability sits at 0.21% (11th percentile), reflecting the significant prerequisite of prior renderer compromise.
Sensitive process memory exposure in Google Chrome for iOS prior to 150.0.7871.47 enables a physically present attacker to read potentially sensitive data from the browser's memory without authentication. The root cause is insufficient data validation (CWE-20) within the iOS-specific Chrome implementation. No public exploit code or CISA KEV listing has been identified at time of analysis, and the physical access requirement (CVSS AV:P) significantly constrains real-world attacker opportunity.
Navigation restriction bypass in Google Chrome for iOS (prior to 150.0.7871.47) permits a remote, unauthenticated attacker to circumvent client-side policy controls by delivering a crafted HTML page to a victim user. The flaw originates from insufficient policy enforcement (CWE-602), where navigation security logic enforced within the browser client can be subverted through malicious web content. No active exploitation has been identified - CISA KEV is not listed, SSVC confirms Exploitation: none, and the EPSS score of 0.22% (13th percentile) reflects minimal real-world exploitation activity at time of analysis.
Cross-origin information disclosure in Apple Safari, iOS, iPadOS, and macOS Tahoe (all versions before 26.5.2) allows an attacker who can direct a user to maliciously crafted web content to read sensitive data from other origins, violating the Same-Origin Policy. The flaw stems from inadequate tracking of security origins in the WebKit engine (CWE-346), and is notable because on iOS and iPadOS all browsers are mandated to use WebKit, meaning every browser on those platforms is affected. No public exploit or CISA KEV listing is identified at time of analysis; Apple has released patches across all affected platforms.
Memory corruption (CWE-119) in Apple Safari's web content processing engine causes an unexpected application crash when rendering maliciously crafted web content. Affected across Safari, iOS 26, iPadOS 26, and macOS Tahoe - all versions prior to 26.5.2. An unauthenticated remote attacker can trigger a denial-of-service against any user who visits a hostile page, though no code execution is indicated by current data. No public exploit code and no CISA KEV listing are identified at time of analysis; exploitation probability (EPSS) was not provided in source data.
Use-after-free memory corruption in Safari's web content rendering engine causes a denial-of-service crash on Apple platforms running Safari, iOS/iPadOS, and macOS Tahoe prior to version 26.5.2. An attacker who can lure a victim to visit a maliciously crafted webpage can reliably crash the Safari browser, with no code execution or data exfiltration indicated by the available CVSS impact scores (C:N/I:N). No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the category of a significant but non-critical browser crash vulnerability.
Clipboard data disclosure in Apple Safari (and the shared WebKit engine on iOS, iPadOS, and macOS) before version 26.5.2 lets a malicious website silently read or hijack clipboard contents without user interaction or permission, rated CVSS 7.5 (confidentiality-only). Apple has shipped fixes in Safari 26.5.2, iOS/iPadOS 26.5.2, and macOS Tahoe 26.5.2, and the issue was reported internally by Apple. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Processing maliciously crafted web content in Apple Safari, iOS/iPadOS, and macOS Tahoe (all versions prior to 26.5.2) triggers an improper memory handling flaw (CWE-119 buffer overflow) in the web content processing pipeline, resulting in an unexpected process crash. The attack vector is network-based requiring user interaction (UI:R per CVSS), and impact is confined to availability - no confidentiality or integrity compromise is described. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog.
Use-after-free memory corruption in Safari's web content rendering engine causes an unexpected application crash when processing maliciously crafted web content. Affected are Apple Safari, iOS and iPadOS, and macOS Tahoe - all prior to version 26.5.2. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) confirms that a remote unauthenticated attacker can trigger this condition simply by luring a user to visit a hostile page, with impact limited to availability (process crash/DoS). No public exploit code identified and not listed in CISA KEV at time of analysis; vendor-released patches are available.
Safari, iOS/iPadOS, and macOS Tahoe expose process memory when the browser engine processes maliciously crafted web content, rooted in a CWE-119 improper memory buffer restriction (tagged Buffer Overflow). The CVSS vector (AV:N/AC:L/PR:N/UI:R/C:H) indicates a network-reachable, low-complexity attack requiring only that the victim visit or render attacker-controlled content, resulting in high confidentiality impact through memory leakage. No active exploitation has been confirmed in CISA KEV and no public proof-of-concept has been identified at the time of analysis; Apple has released patched versions (26.5.2) across all affected platforms.
Memory corruption in Apple's WebKit-based web content processing allows an unauthenticated remote attacker to crash the affected process by luring a user to visit a maliciously crafted webpage. Affected platforms include Safari, iOS, iPadOS, and macOS Tahoe, all prior to version 26.5.2. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog; impact is limited to availability (process crash) with no confirmed confidentiality or integrity exposure.
Use-after-free memory corruption in Apple's WebKit browser engine causes an unexpected process crash when rendering maliciously crafted web content. Safari (all versions prior to 26.5.2), iOS and iPadOS (all versions prior to 26.5.2), and macOS Tahoe (all versions prior to 26.5.2) are affected across Apple's full consumer device ecosystem. No public exploit or CISA KEV listing exists at time of analysis; impact is confirmed as denial-of-service (process crash) only, with no confidentiality or integrity compromise.
Denial-of-service in multiple Apple operating systems allows a local network attacker to cause resource exhaustion and system unavailability. The vulnerability is addressed in iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. No public exploit or active exploitation has been identified at this time, and the EPSS score is low (0.17%).
Authentication bypass via lock screen in macOS allows a person with physical access to view contacts and photos on a locked device. The issue affects macOS prior to Sequoia 15.7.8 and Tahoe 26.6. No active exploitation or public exploit code is reported, but the vulnerability bypasses a fundamental security boundary.
Bypass of iframe sandboxing policy in Apple Safari and all Apple operating systems through version 26.5 allows malicious web content to violate sandbox restrictions. Affected users include anyone running Safari on iOS, iPadOS, macOS Tahoe, tvOS, visionOS, or watchOS prior to version 26.6. An attacker can cause integrity violations, such as injecting or modifying content within sandboxed iframes, but requires user interaction (clicking a link or visiting a malicious page) and no public exploit or active exploitation has been identified at this time.
A malicious app can access sensitive user
Sensitive user data exposure in macOS allows a malicious app to read private information by bypassing access controls. Affected versions are prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No public exploit or active exploitation has been identified; EPSS score of 0.16% indicates a very low probability of widespread attacks.
iOS and iPadOS versions before 26.6 allow a malicious app to modify protected file system areas via a race condition. The vulnerability, tracked as CVE-2026-43811, requires local user interaction and has no known public exploit or active exploitation, with EPSS indicating very low real-world likelihood.
Information disclosure in macOS asset catalog processing allows local attackers to read process memory by enticing a user to open a malicious asset catalog. Affected versions prior to macOS Sequoia 15.7.8 and Sonoma 14.8.8 are vulnerable. No active exploitation or public exploit code exists; EPSS indicates low exploitation probability.
An inconsistent user interface state management in multiple Apple operating systems allows remote attackers to bypass network filters, potentially leading to unauthorized actions on the system. The vulnerability requires user interaction (e.g., clicking a link) and affects iOS and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. No active exploitation has been reported at this time, and the EPSS score (0.27%, 20th percentile) indicates a low immediate threat.
Protected user data exposure in Apple operating systems allows a malicious app with on-device access to read sensitive information through insufficient input sanitization. This CVE-2026-43714 affects iOS and iPadOS before 26.6, macOS Sequoia before 15.7.8, Sonoma before 14.8.8, Tahoe before 26.6, visionOS before 26.6, and watchOS before 26.6. No public exploit has been identified and the low EPSS score
An authorization bypass vulnerability in Apple macOS allows a local application to access sensitive user data without proper authorization. This issue is fixed in macOS Sequoia 15.7.8 and macOS Tahoe 26.6. No active exploitation (not in CISA KEV) or public proof-of-concept has been identified, and EPSS scores the exploitation probability as low (0.15%).
Denial-of-service via type confusion in Apple ImageIO affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Processing a maliciously crafted image can crash an application, with no code execution. No active exploitation or public exploit is known; EPSS 0.17% indicates low likelihood of widespread attacks.
Sandbox escape in macOS allows a malicious app to read files outside its sandbox. Affects macOS Sonoma prior to 14.8.8, Sequoia prior to 15.7.8, and Tahoe prior to 26.6. No active exploitation or public exploit
Cleartext transmission of sensitive data in Apple iOS 26.6 and earlier allows an app to access sensitive user data over the network. The issue is fixed by enforcing HTTPS in iOS and iPadOS 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. No public exploit has been identified and EPSS risk is low (0.16%).
Local information disclosure in macOS Tahoe and watchOS allows an installed app to access sensitive user data without proper authorization. The vulnerability requires user interaction and is fixed in macOS Tahoe 26.6 and watchOS 26.6. No active exploitation or public exploit has been reported, and EPSS probability is low at 0.15%.
We are tasked with synthesizing data from multiple intelligence sources about CVE-2026-64754 into a comprehensive analysis, returning a JSON object with specific fields. All fields must be plain text strings (paragraphs). We must use all provided data and cross-reference to add value. The output must be grounded in the input data, not invented. Let's extract and analyze the provided data: - CVE ID: CVE-2026-64754 - Description: "An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to a denial-of-service." - CVSS Score: 5.5, Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CWE: CWE-787 (Out-of-bounds Write) - EPSS: 0.16% (percentile 5%) — low exploitation probability. - Patch: Available from vendor (Yes). The fix is listed in the versions above. - Reported by: apple - CPE: apple:ios_and_ipados, apple:macos, apple:tvos, apple:visionos, apple:watchos — all with *:*:*:*:*:*:*. Specific version ranges given by EUVD: macOS 0 <15.7.8, macOS 0 <14.8.8, iOS and iPadOS 0 <26.6, macOS 0 <26.6, watchOS 0 <26.6, tvOS 0 <26.6, visionOS 0 <26.6. Note the macOS versions include Sequoia 15.7.8 fix, Sonoma 14.8.8, Tahoe 26.6. "macOS 0 <26.6" likely means macOS Tahoe (version 26.x). So affected products: all Apple operating systems before these fixed versions. - Tags: Apple, Buffer Overflow, Ios And Ipados, Tvos, Visionos, Watchos, Memory Corruption. Also "Memory Corruption" tag is relevant. - References: All are Apple support pages: 128066, 128067, 128068, 128069, 128070, 128071, 128072. Also ENISA EUVD ID: EUVD-2026-49465, with link to NVD. Now, we need to produce each field as a paragraph. 1. product_name: "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'. NOT
Information disclosure in iOS and iPadOS versions before 26.6 allows a locally installed malicious application to access sensitive user data without proper authorization. Apple addressed the flaw in iOS 26.6 and iPadOS 26.6 with improved state management; no active exploitation or public proof-of-concept has been identified. The EPSS exploitation probability is low (0.14%), consistent with the local attack vector and required user interaction.
Sensitive user data can be accessed by unauthorized apps on macOS and watchOS due to an authorization flaw in state management. Apple released patches in macOS Sequoia 15.7.8, Sonoma 14.8.8, Tahoe 26.6, and watchOS 26.6. No public exploit or active exploitation is known; EPSS indicates a low likelihood of exploitation.
An authorization bypass in Apple iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS versions before 26.6 allows an app to access sensitive user data without proper permission. The vulnerability requires user interaction (opening a malicious app) and has not been actively exploited, with no CISA KEV listing and a low EPSS probability of 0.16%.
Out-of-bounds read in Apple macOS allows a local app to access sensitive user data. The vulnerability (CWE-787) has been patched in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. Exploitation requires user interaction (opening a malicious app or file), and no public exploits are known to be in the wild.
Sensitive kernel state leak in macOS allows a local application to read kernel memory. Apple fixed this in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 by improving redaction. The vulnerability has low exploitation probability (EPSS 0.16%) and is not known to be actively exploited.
Unexpected Safari crash via use-after-free when processing maliciously crafted web content affects Safari 26.6 and earlier on all Apple platforms. This denial-of-service condition requires user interaction to open a malicious webpage; no public exploit identified and EPSS probability is low (0.14%).
Information disclosure in Apple Contacts across iOS, iPadOS, macOS, visionOS, and watchOS allows a local attacker to leak sensitive data by processing a maliciously crafted contact. Apple has released patches in iOS 26.6 and other updates. No public exploit is identified, and EPSS indicates
Sensitive information disclosure vulnerability in macOS via a race condition allows a local malicious application to access user data. Apple fixed the issue in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No active exploitation or public proof-of-concept is known.
Denial of service in macOS Tahoe fixed by removing vulnerable code. A local attacker with low privileges can cause a denial-of-service condition. No active exploitation or public exploit known, and the low EPSS score (0.14%) indicates limited real-world risk.
Denial of service in Apple operating systems via out-of-bounds write allows a local app to cause unexpected system termination. Affected versions include iOS/iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS prior to 26.6. No active exploitation has been reported, EPSS risk is low at 0.16%, and no public exploit code identified at time of analysis.
A buffer overflow in the processing of 3D models on Apple iOS, iPadOS, and macOS leads to disclosure of process memory. Affected versions include iOS/iPadOS prior to 26.6 and macOS prior to Sequoia 15.7.8 and Tahoe 26.6. An attacker who can deliver a malicious 3D model to a victim could leak sensitive information; no active exploitation or public exploit has been reported, and the EPSS probability is low (0.18%).
Information disclosure in Apple iOS, iPadOS, and macOS Tahoe allows a malicious app with local access to read a user's contacts database. The flaw is fixed in iOS 26.6, iPadOS 26.6, and macOS Tahoe 26.6. No public exploit or active exploitation has been reported, and the EPSS score (0.15%) indicates low exploitation likelihood.
In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire: isight: bound the sample count to the packet payload isight_packet() takes the frame count from the device iso packet and checks it only against the device claimed iso length. count = be32_to_cpu(payload->sample_count); if (likely(count <= (length - 16) / 4)) isight_samples(isight, payload->samples, count); length is the iso header data_length. It can be up to 0xffff. So the gate allows a count up to about 16379. isight_samples() then copies count frames out of payload->samples into the PCM DMA buffer. payload->samples holds only 2 * MAX_FRAMES_PER_PACKET values. The device multiplexes two samples per frame. A count past MAX_FRAMES_PER_PACKET reads past the payload. A count past the buffer size writes past runtime->dma_area. The smallest PCM buffer is larger than MAX_FRAMES_PER_PACKET. Bounding the count to MAX_FRAMES_PER_PACKET keeps both the read and the write in range. A malicious or faulty Apple iSight on the FireWire bus reaches this during a normal capture. Add the MAX_FRAMES_PER_PACKET bound to the gate.
HTTP request smuggling in SwiftNIO HTTP/2 allows unauthenticated remote attackers to inject headers or split responses via crafted HTTP/2 HEADERS frames that pass control characters through the HTTP/2-to-HTTP/1.1 codec. The vulnerability, caused by missing CR/LF/NUL/SP validation in regular header values and pseudo-headers, can be exploited when outbound validation is disabled or headers are forwarded without rechecking. Fixed in version 1.45.0; no public exploit identified at time of analysis and EPSS score is 0.14% (low).
Uncontrolled resource consumption in dompdf's BMP image processing pipeline allows any unauthenticated attacker who can submit HTML to a dompdf-powered endpoint to exhaust server memory and stall PHP-FPM worker pools with a 169-byte HTTP request. The library trusts attacker-controlled BMP header dimensions without bounding width × height, causing PHP's GD extension to allocate a full native pixel canvas - bypassing PHP's memory_limit entirely because GD allocates through its own native allocator. A publicly available, verified proof-of-concept demonstrates ~12× memory amplification (34 MB control vs ~412 MB attack peak RSS) from identically-sized requests, making this a high-impact, low-effort denial-of-service primitive. No active exploitation confirmed in CISA KEV at time of analysis.
Shell sandbox bypass in the optional @n8n/computer-use package for n8n exposes the full host filesystem and network to any privileged user who can invoke a computer-use workflow on Linux or Windows, because sandboxing was only implemented for macOS. Affected are n8n versions before 2.29.8 and 2.30.x before 2.30.1; standard n8n installations without the @n8n/computer-use package are entirely unaffected. No public exploit has been identified at time of analysis, but the subsequent-system impact is rated High across confidentiality, integrity, and availability in the vendor-sourced CVSS 4.0 vector.
Draft release attachment disclosure in Gitea exposes files uploaded to draft releases to unauthenticated network callers via UUID-based web endpoints, bypassing access controls that correctly gate the parallel API handlers. This is an incomplete fix for CVE-2026-27660: that advisory's PR #36659 added `canAccessReleaseDraft` checks to every API code path but left the web-side `ServeAttachment` handler ungated, allowing anyone who obtains an attachment UUID to download its contents with no authentication. A working proof-of-concept is documented in the advisory and confirmed against Gitea v1.27.0+dev; no public exploit identified at time of analysis beyond the advisory PoC, and the vulnerability does not appear in CISA KEV.
Apple's Find My backend service allows an attacker who holds a valid PET (Private Endpoint Token) to enumerate devices on an Apple ID account and silently remove offline devices without triggering two-factor authentication or ownership verification - a CWE-287 Improper Authentication flaw. The vulnerability affects the service through at least December 17, 2025, with researcher-published proof-of-concept code on GitHub demonstrating the technique. EPSS sits at 0.19% (9th percentile) and the vulnerability is not listed in CISA KEV, pointing toward targeted rather than opportunistic exploitation; however, the account-manipulation impact makes it meaningful for high-value Apple ID targets.
Policy signing key bypass in ClearanceKit prior to 5.0.10 permits any root process on macOS to forge valid signatures over arbitrary policy database content, granting full control over ClearanceKit's per-process file-system access enforcement plane. The root cause is a silent ACL failure specific to the macOS legacy System Keychain: ECDSA key items persisted via SecItemAdd silently lose their kSecAttrAccess restriction, leaving the signing key unrestricted to any root caller. No public exploit has been identified and no CISA KEV listing exists, but the integrity impact extends beyond the vulnerable component to the entire policy enforcement layer ClearanceKit provides.
ClearanceKit's on-disk SQLite policy store on macOS is vulnerable to a replay attack that allows a high-privileged local attacker to substitute a previously-captured, legitimately-signed policy snapshot, causing the opfilter component to enforce outdated or permissive per-process file-access policies on the next boot. All releases prior to version 5.0.10 are affected, with exploitation gated to specific windows: the opfilter-update period when the Endpoint Security filter is offline, offline-boot scenarios, or decrypted-backup restoration. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS data was not provided in available intelligence.
Cyrus IMAP through version 3.12.2 contains an authorization flaw in its XAPPLEPUSHSERVICE (XAPS) command that lets authenticated IMAP users enumerate arbitrary mailboxes belonging to other accounts and redirect Apple Push Notification Service alerts about those mailboxes to their own device. The flaw (CWE-863, Incorrect Authorization) does not expose message content - only whether a target mailbox exists and when its modification sequence (modseq) changes - but it enables cross-account probing and unauthorized push subscription in multi-tenant IMAP deployments. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; the low CVSS score of 3.1 is consistent with the limited confidentiality impact and mandatory authentication requirement.
Drive-by local filesystem exfiltration in FiftyOne versions below 1.17.0 allows any malicious website to silently read arbitrary files from a victim's machine. The FiftyOne App server unconditionally returns Access-Control-Allow-Origin: * on all responses, and the unauthenticated /media endpoint serves local filesystem files by path - together these let JavaScript on any visited webpage fetch files such as SSH keys, cloud credentials, or .env files from localhost:5151 and relay them to an attacker-controlled server. No public exploit (KEV or confirmed POC) is identified at time of analysis, but the attack requires no special tooling and is trivially reproducible in Safari and Firefox, which lack Private Network Access protections.
Unbounded goroutine accumulation in Hoverfly v1.12.7 and earlier allows remote denial of service via its remote post-serve action feature. The unauthenticated admin API permits any network-reachable attacker to register a post-serve action pointing at a black-hole TCP endpoint, load a catch-all simulation, then flood the proxy port - each matching request spawns a goroutine that blocks indefinitely in `http.DefaultClient.Do()`, consuming approximately 66 KB each until the process is OOM-killed. A detailed proof-of-concept with verified memory measurements is publicly available in GitHub Security Advisory GHSA-42j2-w334-qxw7; no CISA KEV listing has been recorded at time of analysis.
PDF save functionality in Firefox for iOS allows maliciously crafted page titles to manipulate the output file path, enabling overwrites of existing PDF files or bundled application content within the Firefox iOS sandbox. All versions prior to 152.4 on Apple iOS devices are affected. An attacker operating a malicious website can lure a user into saving a page as PDF, causing the crafted title to resolve to an unintended file path within the app sandbox - potentially corrupting application state or stored documents. No public exploit has been identified at time of analysis, though SSVC classifies the vulnerability as automatable with partial technical impact.
Open redirect bypass in openrun prior to v0.17.7 allows remote unauthenticated attackers to redirect victims to arbitrary external URLs by exploiting a double-slash path prefix that evades the application's host/scheme validation. The referrer-based redirect logic correctly validates the host and scheme but passes the extracted path `//attacker.com` to the Location header, which browsers interpret as a protocol-relative URL and resolve to an external destination. A proof-of-concept is publicly documented in the security advisory; no active exploitation has been confirmed by CISA KEV at time of analysis.
Privilege escalation in Palo Alto Networks Prisma® Browser on macOS enables a locally authenticated administrator with access to the local filesystem to perform actions at root privilege level. The vulnerability is scoped exclusively to macOS deployments of Prisma Browser - no other platforms or Palo Alto products are implicated per the advisory. No public exploit identified at time of analysis; the CVSS 4.0 base score of 2.0 reflects the substantial exploitation prerequisites that materially constrain real-world risk despite the full-system impact potential at root level.
Improper certificate validation in the Palo Alto Networks Prisma Access Agent for iOS exposes VPN tunnel traffic to interception and manipulation by a network-adjacent attacker. The flaw (CWE-295) enables a man-in-the-middle position to defeat the agent's TLS/certificate trust chain, allowing an adversary to read or alter traffic that the iOS client believes is securely tunneled. Exploitation is limited to iOS deployments - the Windows, macOS, Linux, Android, and ChromeOS agents are confirmed unaffected. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog.
Multiple protection mechanism failures in the Data Loss Prevention (DLP) component of Palo Alto Networks Prisma Access Agent for Windows enable a local authenticated user to bypass DLP policy enforcement controls. Only the Windows platform is affected; the Prisma Access Agent for macOS is explicitly excluded per vendor advisory. No public exploit code or active exploitation has been identified at time of analysis, though the CVSS 4.0 supplemental urgency rating of Amber and high confidentiality/integrity impact on the vulnerable system make this a meaningful insider threat risk.
Setuptools prior to 83.0.0 fails to normalize Unicode filenames before matching them against MANIFEST.in exclusion patterns on macOS APFS and HFS+ filesystems, allowing files with NFD-normalized on-disk names to silently bypass NFC-encoded exclude, global-exclude, recursive-exclude, and prune directives and be packed into Python source distributions. Python package maintainers developing on macOS face a supply chain risk: sensitive files such as credentials, private keys, or environment configs that are correctly listed in MANIFEST.in for exclusion may still appear in tarballs published to PyPI or private registries. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Address bar spoofing in Firefox for iOS allows a remote unauthenticated attacker to display a trusted origin in the browser's address bar while the victim views and interacts with fully attacker-controlled content - a classic and effective phishing enabler. The attack exploits a race condition in navigation handling: a malicious page enqueues a synchronous JavaScript dialog at the moment a user navigates away, freezing the address bar on the destination's legitimate origin while the malicious page's content continues to render. No public exploit code has been identified and EPSS is 0.15% (4th percentile), indicating no observed widespread exploitation; however, the technique is conceptually simple and phishing value is high.
Remote image auto-fetch in the OpenAI Codex desktop app for macOS (versions prior to 26.527.31326) enables silent exfiltration of session secrets via indirect prompt injection. An attacker who can place malicious instructions into content processed by Codex - such as a tool result, API response, or file read during a session - can manipulate the model into generating a Markdown image tag whose URL encodes sensitive data; the app then automatically fetches that URL, transmitting API keys, source code, or tool-returned data to an attacker-controlled server with no additional user action. No active exploitation is confirmed (not listed in CISA KEV), no public proof-of-concept is identified, and EPSS sits at 0.16% (6th percentile), indicating low current exploitation probability despite the high-value target profile of affected users.
OS command injection in create-react-app's react-dev-utils component enables remote code execution on macOS developer workstations running version 5.0.1 or earlier. The vulnerability resides in the startBrowserProcess function of openBrowser.js, which processes unsanitized input that reaches a shell invocation. A publicly available proof-of-concept exploit exists via the project's GitHub issue tracker; no vendor patch has been released and the maintainers have not responded to disclosure, leaving the entire supported version history of this widely-used but now-archived tool permanently unpatched.
Local privilege escalation in Cato Client on macOS allows an authenticated low-privileged user to gain root by chaining two flaws in the PrivilegedHelperTool XPC service: improper certificate validation (CWE-295) that accepts self-signed certificates to bypass XPC caller verification, and a TOCTOU race condition exploitable via symlink swap during package installation. All Cato Client (SDP Client) versions prior to 5.13.1 on macOS are affected. A proof-of-concept exists per the CVSS 4.0 supplemental metric E:P, and the AU:Y (Automatable) tag indicates the exploit chain can be scripted - elevating practical urgency despite the absence of a CISA KEV listing.
UI spoofing in Google Chrome's Passwords feature on iOS (versions prior to 150.0.7871.47) enables remote attackers to manipulate the presentation of security-critical password UI elements via a specially crafted HTML page. Users who visit a malicious page in Chrome on iOS may see misleading security indicators or spoofed password dialogs, potentially deceiving them into unintended credential interactions. No public exploit identified at time of analysis; EPSS is 0.18% (8th percentile), and SSVC confirms no observed exploitation - risk is real but low-priority relative to the broader threat landscape.
UI spoofing in Google Chrome for iOS prior to 150.0.7871.47 allows a remote attacker to manipulate browser interface elements via a crafted HTML page, provided the attacker can lure the victim into performing specific UI gestures. The root cause is insufficient validation of untrusted HTML input (CWE-20) within Chrome's iOS-specific rendering layer, resulting in low-integrity and low-availability impact. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog; Chromium's own severity classification is Low.
UI spoofing in Google Chrome for iOS prior to 150.0.7871.47 allows a remote, unauthenticated attacker to misrepresent browser interface elements by delivering a crafted HTML page to a victim who visits it. Rooted in CWE-451 (UI Misrepresentation of Critical Information), the flaw arises from insufficient validation of untrusted HTML input in the iOS-specific Chrome rendering pipeline, enabling manipulation of trust signals such as address bar display or security indicators. No public exploit identified at time of analysis; EPSS at 0.18% (8th percentile) and SSVC Exploitation: none confirm negligible current threat actor interest.
Omnibox spoofing in Google Chrome for iOS prior to 150.0.7871.47 enables remote attackers to display false URL content in the browser's address bar by luring a user to a crafted HTML page, creating a credible phishing vector. The flaw stems from inappropriate implementation in the iOS-specific Omnibox rendering logic (CWE-451), distinct from Chrome's desktop codebase. No public exploit code has been identified and EPSS sits at 0.18% (8th percentile), indicating negligible opportunistic exploitation probability at this time.
Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 150.0.7871.47 allows a remote attacker to display a fraudulent URL in the browser's address bar by delivering a crafted HTML page. The root cause is classified as CWE-451 (UI Misrepresentation of Critical Information), meaning the security UI fails to accurately reflect the true origin of displayed content - a condition that directly undermines phishing defenses. No public exploit code has been identified at time of analysis, and the EPSS score of 0.18% (8th percentile) indicates very low observed exploitation pressure, consistent with the Chromium team's own 'Low' severity rating.
No-referrer policy bypass in Google Chrome for iOS prior to 150.0.7871.47 allows a remote attacker to capture referrer URL information that the browser was supposed to suppress. Exploitation requires user interaction - the victim must visit a crafted HTML page served by the attacker - and exploits a client-side enforcement gap (CWE-602) specific to the iOS build of Chrome. EPSS is 0.19% (9th percentile) and no active exploitation or KEV listing exists, consistent with the Low Chromium severity rating.
Side-channel information leakage in the WebAuthentication component of Google Chrome on iOS (prior to 150.0.7871.47) exposes cross-origin data to remote attackers via a crafted HTML page, requiring only that a victim visit attacker-controlled content. The CVSS Confidentiality:High rating reflects the category of cross-origin data exposure, while Chromium's own internal severity classification of Low and an EPSS score of 0.21% (11th percentile) both signal that practical exploitation is considered unlikely at scale. No public exploit is identified at time of analysis and no CISA KEV listing exists.
Universal Cross-Site Scripting (UXSS) in Chrome's Omnibox on iOS enables remote attackers to inject arbitrary scripts or HTML across security origins by luring users into performing specific UI gestures on a crafted page. Affected versions are Chrome for iOS prior to 150.0.7871.47; the desktop channel is not affected. No public exploit code or active exploitation has been identified at time of analysis, and EPSS sits at 0.18% (8th percentile), consistent with Chromium's own 'Low' severity rating despite the scope-changed CVSS vector.
Navigation restriction bypass in Google Chrome for iOS prior to 150.0.7871.47 allows a remote, unauthenticated attacker to circumvent browser-enforced navigation controls by delivering a crafted HTML page. The flaw is confined to the iOS platform - Chrome on Android, Windows, macOS, and Linux is unaffected - and requires the victim to actively visit the attacker-controlled page (UI:R). With a CVSS score of 4.3 (Medium), an EPSS of 0.19% (9th percentile), no CISA KEV listing, and a Chromium-internal severity rating of Low, this vulnerability carries minimal real-world exploitation risk but warrants patching given its zero-privilege attack vector.
UI spoofing in Google Chrome for iOS prior to 150.0.7871.47 allows a remote attacker to misrepresent security indicators to users who are socially engineered into performing specific UI gestures on a crafted HTML page. The root cause is incorrect rendering of security UI elements (CWE-451), classified by the Chromium team as Low severity. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog, aligning with the modest CVSS 4.2 score and the high-complexity attack requirements.
UI spoofing in Google Chrome for iOS prior to version 150.0.7871.47 enables remote attackers to manipulate browser interface elements through a specially crafted HTML page, potentially deceiving users into believing they are interacting with a trusted site. The flaw arises from insufficient validation of untrusted input (CWE-20) in the iOS-specific Chrome layer and requires user interaction - a victim must navigate to a malicious page. No public exploit exists, CISA has not listed this in KEV, and an EPSS score of 0.17% (7th percentile) confirms very low real-world exploitation probability at the time of analysis.
Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 150.0.7871.47 enables a remote attacker to display falsified URL content to a victim user via a crafted HTML page. Exploitation requires convincing the target to perform specific UI gestures while visiting the malicious page, making this a phishing-enabler rather than a direct code-execution primitive. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; Google has released a fix in the 150.0.7871.47 stable channel update.
UI spoofing in Google Chrome for iOS prior to version 150.0.7871.47 enables a remote attacker to misrepresent page identity or security state through a specially crafted HTML page, exploiting an inappropriate implementation classified under CWE-451. The vulnerability affects only the iOS-specific Chrome codebase - not Chrome on other platforms - and requires user interaction (visiting an attacker-controlled page). No public exploit code has been identified and EPSS sits at 0.21% (11th percentile), indicating low observed exploitation probability; it is not listed in the CISA KEV catalog.
UI spoofing in Google Chrome for iOS prior to 150.0.7871.47 enables a remote unauthenticated attacker to misrepresent browser interface elements - such as the address bar or security indicators - through a specially crafted HTML page, potentially deceiving users about the origin or trustworthiness of web content. The CVSS vector (PR:N, UI:R) confirms no authentication is required but user interaction is necessary, and the SSVC framework rates exploitation as 'none' with partial technical impact. EPSS at 0.21% (11th percentile) and the absence of any KEV listing or public exploit code indicate no public exploitation activity at time of analysis.
Cross-origin data leakage in Google Chrome on iOS (prior to 150.0.7871.47) stems from an inappropriate implementation in the ScriptInjections subsystem, exploitable by a remote attacker who can lure a victim to a crafted HTML page. The flaw allows the attacker's origin to read data belonging to a different, protected origin - a fundamental violation of the Same-Origin Policy on Apple's iOS platform. No public exploit code has been identified at time of analysis, EPSS places exploitation probability at 0.22% (13th percentile), and SSVC signals no observed active exploitation, making this a medium-priority patch item despite its cross-origin impact.
Navigation restriction bypass in Google Chrome for iOS (prior to 150.0.7871.47) allows a remote attacker to subvert browser-enforced navigation controls by luring a user into performing specific UI gestures on a crafted HTML page. Classified as CWE-20 (Improper Input Validation), the flaw undermines integrity by permitting unauthorized navigation that the browser is intended to block. No public exploit code exists and EPSS sits at 0.22% (13th percentile), indicating low observed exploitation probability; the vulnerability is not listed in CISA KEV.
UI spoofing in Google Chrome for iOS prior to version 150.0.7871.47 allows a remote attacker to misrepresent browser interface elements - such as the address bar or origin indicators - by serving a crafted HTML page, potentially deceiving users into trusting malicious content. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms network-reachable exploitation with no privilege requirement but mandatory user interaction, limiting impact to partial integrity loss with no confidentiality or availability effect. No public exploit or active exploitation has been identified; an EPSS score of 0.21% at the 11th percentile indicates very low current exploitation probability, and this vulnerability does not appear in the CISA KEV catalog.
Cross-origin data leakage in Google Chrome's Autofill subsystem on iOS (versions prior to 150.0.7871.47) enables remote attackers to read sensitive data across origin boundaries by luring victims into performing specific UI gestures on a crafted page. Rooted in CWE-346 (Origin Validation Error), the Autofill policy enforcement layer fails to maintain proper origin isolation under targeted interaction conditions. With an EPSS of 0.21% (11th percentile) and no CISA KEV listing, no public exploit identified at time of analysis, though the CVSS-rated High confidentiality impact warrants prompt patching given Chrome's broad iOS deployment footprint.
UI spoofing in Google Chrome's Safe Browsing component on iOS enables remote attackers to mislead users through a crafted HTML page, potentially causing them to dismiss or misinterpret security warnings. Only Chrome for iOS versions prior to 150.0.7871.47 are affected; the desktop channel is not impacted by this specific flaw. No public exploit code exists and exploitation probability is very low (EPSS 0.21%, 11th percentile), though the network-accessible, zero-authentication attack surface keeps it relevant where phishing-style delivery is feasible.
Navigation restriction bypass in Google Chrome's Omnibox on iOS (prior to 150.0.7871.47) enables a remote attacker to circumvent address bar security controls through insufficient input validation, contingent on user interaction with specific UI gestures during exposure to malicious network traffic. The integrity impact is rated High (I:H) with no confidentiality or availability impact, consistent with a content/navigation spoofing class of vulnerability. No public exploit code or CISA KEV listing has been identified; EPSS score of 0.20% (10th percentile) indicates low observed exploitation probability at time of analysis.
UI spoofing in Google Chrome's iOSWeb component on iOS allows remote attackers to misrepresent interface elements to users running versions prior to 150.0.7871.47. The vulnerability, rooted in an inappropriate implementation (CWE-451), is triggered when a user performs specific UI gestures on a crafted HTML page, enabling spoofing of security-critical browser interface elements such as the address bar or permission dialogs. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the high attack complexity and mandatory user interaction meaningfully constrain real-world risk.
Race condition exploitation in Google Chrome for iOS (prior to 150.0.7871.47) exposes potentially sensitive data from process memory to a local attacker with physical device access. The flaw is rooted in improper synchronization (CWE-362) and requires high attack complexity to successfully win the timing window. No public exploit has been identified and the vulnerability is not listed in CISA KEV; the vendor has released a patching fix in the 150.0.7871.47 stable channel update.
Navigation restriction bypass in Google Chrome's Safe Browsing implementation on iOS allows a remote, unauthenticated attacker to circumvent phishing and malicious-site protections via a specially crafted HTML page, affecting all Chrome for iOS versions prior to 150.0.7871.47. The flaw is classified as CWE-693 (Protection Mechanism Failure), meaning the Safe Browsing guard can be rendered ineffective rather than defeated through cryptographic or authentication means. No public exploit or CISA KEV listing has been identified, and the EPSS score of 0.23% (14th percentile) signals low current exploitation probability - but the zero-prerequisite network delivery and high integrity impact make this a meaningful risk for iOS users who have not updated.
UI spoofing in Google Chrome for iOS prior to version 150.0.7871.47 enables remote attackers to misrepresent browser interface elements - such as address bars or security indicators - by delivering a crafted HTML page to a victim on an iOS device. Rooted in CWE-451 (UI Misrepresentation of Critical Information), the flaw exploits an inappropriate implementation specific to Chrome's iOS code path, which differs from desktop Chrome due to WKWebView constraints imposed by Apple. No public exploit code exists, CISA SSVC rates exploitation as none, and EPSS sits at the 12th percentile, indicating minimal real-world threat at time of analysis.
Cross-origin data leakage in Google Chrome for iOS prior to 150.0.7871.47 exposes sensitive information from other origins when a remote attacker convinces a victim to perform specific UI gestures on a crafted HTML page. The flaw stems from an inappropriate implementation in the iOS-specific Chrome browser layer, classified under CWE-451 (UI Misrepresentation), and enables confidentiality compromise without requiring attacker privileges. No public exploit code has been identified at time of analysis, and EPSS at 0.22% (12th percentile) signals low near-term automated exploitation risk.
Side-channel information leakage in WebAuthentication within Google Chrome on iOS (versions prior to 150.0.7871.47) enables a remote attacker to infer cross-origin data by directing a victim to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms network-exploitable impact with high confidentiality loss, constrained by mandatory user interaction and scoped exclusively to the iOS platform. No public exploit identified at time of analysis; EPSS at 0.25% (16th percentile) signals low near-term exploitation probability, and no CISA KEV listing is present.
Insufficient Web Authentication (WebAuthn/Passkeys) policy enforcement in Google Chrome on iOS prior to 150.0.7871.47 enables cross-origin data leakage to an attacker controlling a privileged network position. The flaw stems from CWE-693 (Protection Mechanism Failure) in the browser's WebAuthn subsystem, which fails to enforce origin isolation correctly when processing crafted HTML pages. No public exploit code exists and CISA has not listed this in KEV, but the high confidentiality impact (C:H) and the specificity of Chrome-on-iOS as the attack surface make this a targeted patching priority for organizations with a managed iOS fleet.
Cross-origin data leakage in Google Chrome for iOS prior to 150.0.7871.47 enables remote attackers to exfiltrate sensitive information from other origins by luring victims to a crafted HTML page that exploits insufficient input validation. The vulnerability carries a CVSS 6.5 with high confidentiality impact (AV:N/PR:N/C:H) but requires user interaction and is iOS-platform-specific, constraining the realistic attack surface. No public exploit or active exploitation has been identified at time of analysis; EPSS is 0.22% at the 12th percentile and SSVC rates exploitation as none.
Omnibox spoofing in Google Chrome for iOS prior to 150.0.7871.47 enables remote unauthenticated attackers to display a falsified URL in the browser address bar by delivering a crafted HTML page to an iOS user. The flaw is classified CWE-451 (UI misrepresentation of critical information) and is iOS-platform-specific, with no impact on Chrome for Android, Windows, macOS, or Linux. No active exploitation is confirmed - the vulnerability is not listed in CISA KEV and EPSS sits at 0.22% (12th percentile) - but the spoofing primitive is a classic enabler of targeted phishing campaigns against mobile users.
Universal Cross-Site Scripting (UXSS) in Google Chrome for iOS prior to 150.0.7871.47 enables a remote attacker to inject arbitrary scripts or HTML across origins by exploiting insufficient input validation triggered through specific user UI gestures on a crafted page. The scope change (S:C in CVSS) is the critical dimension here - successful exploitation bypasses the same-origin policy, potentially granting the attacker script execution in the context of arbitrary origins within the browser session. No public exploit code has been identified and EPSS sits at just 0.20% (11th percentile), indicating low observed exploitation activity despite the high-impact class of vulnerability.
Cross-origin data leakage via side-channel in Google Chrome's Safe Browsing component on iOS affects all Chrome versions prior to 150.0.7871.47, exploitable only by an attacker who has already compromised the renderer process. The vulnerability (CWE-1300) allows confidentiality impact through a crafted HTML page that abuses Safe Browsing timing or state signals to exfiltrate data across origin boundaries. No public exploit code exists at time of analysis, SSVC records exploitation as none, and EPSS probability sits at 0.21% (11th percentile), reflecting the significant prerequisite of prior renderer compromise.
Sensitive process memory exposure in Google Chrome for iOS prior to 150.0.7871.47 enables a physically present attacker to read potentially sensitive data from the browser's memory without authentication. The root cause is insufficient data validation (CWE-20) within the iOS-specific Chrome implementation. No public exploit code or CISA KEV listing has been identified at time of analysis, and the physical access requirement (CVSS AV:P) significantly constrains real-world attacker opportunity.
Navigation restriction bypass in Google Chrome for iOS (prior to 150.0.7871.47) permits a remote, unauthenticated attacker to circumvent client-side policy controls by delivering a crafted HTML page to a victim user. The flaw originates from insufficient policy enforcement (CWE-602), where navigation security logic enforced within the browser client can be subverted through malicious web content. No active exploitation has been identified - CISA KEV is not listed, SSVC confirms Exploitation: none, and the EPSS score of 0.22% (13th percentile) reflects minimal real-world exploitation activity at time of analysis.
Cross-origin information disclosure in Apple Safari, iOS, iPadOS, and macOS Tahoe (all versions before 26.5.2) allows an attacker who can direct a user to maliciously crafted web content to read sensitive data from other origins, violating the Same-Origin Policy. The flaw stems from inadequate tracking of security origins in the WebKit engine (CWE-346), and is notable because on iOS and iPadOS all browsers are mandated to use WebKit, meaning every browser on those platforms is affected. No public exploit or CISA KEV listing is identified at time of analysis; Apple has released patches across all affected platforms.
Memory corruption (CWE-119) in Apple Safari's web content processing engine causes an unexpected application crash when rendering maliciously crafted web content. Affected across Safari, iOS 26, iPadOS 26, and macOS Tahoe - all versions prior to 26.5.2. An unauthenticated remote attacker can trigger a denial-of-service against any user who visits a hostile page, though no code execution is indicated by current data. No public exploit code and no CISA KEV listing are identified at time of analysis; exploitation probability (EPSS) was not provided in source data.
Use-after-free memory corruption in Safari's web content rendering engine causes a denial-of-service crash on Apple platforms running Safari, iOS/iPadOS, and macOS Tahoe prior to version 26.5.2. An attacker who can lure a victim to visit a maliciously crafted webpage can reliably crash the Safari browser, with no code execution or data exfiltration indicated by the available CVSS impact scores (C:N/I:N). No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the category of a significant but non-critical browser crash vulnerability.
Clipboard data disclosure in Apple Safari (and the shared WebKit engine on iOS, iPadOS, and macOS) before version 26.5.2 lets a malicious website silently read or hijack clipboard contents without user interaction or permission, rated CVSS 7.5 (confidentiality-only). Apple has shipped fixes in Safari 26.5.2, iOS/iPadOS 26.5.2, and macOS Tahoe 26.5.2, and the issue was reported internally by Apple. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Processing maliciously crafted web content in Apple Safari, iOS/iPadOS, and macOS Tahoe (all versions prior to 26.5.2) triggers an improper memory handling flaw (CWE-119 buffer overflow) in the web content processing pipeline, resulting in an unexpected process crash. The attack vector is network-based requiring user interaction (UI:R per CVSS), and impact is confined to availability - no confidentiality or integrity compromise is described. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog.
Use-after-free memory corruption in Safari's web content rendering engine causes an unexpected application crash when processing maliciously crafted web content. Affected are Apple Safari, iOS and iPadOS, and macOS Tahoe - all prior to version 26.5.2. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) confirms that a remote unauthenticated attacker can trigger this condition simply by luring a user to visit a hostile page, with impact limited to availability (process crash/DoS). No public exploit code identified and not listed in CISA KEV at time of analysis; vendor-released patches are available.
Safari, iOS/iPadOS, and macOS Tahoe expose process memory when the browser engine processes maliciously crafted web content, rooted in a CWE-119 improper memory buffer restriction (tagged Buffer Overflow). The CVSS vector (AV:N/AC:L/PR:N/UI:R/C:H) indicates a network-reachable, low-complexity attack requiring only that the victim visit or render attacker-controlled content, resulting in high confidentiality impact through memory leakage. No active exploitation has been confirmed in CISA KEV and no public proof-of-concept has been identified at the time of analysis; Apple has released patched versions (26.5.2) across all affected platforms.
Memory corruption in Apple's WebKit-based web content processing allows an unauthenticated remote attacker to crash the affected process by luring a user to visit a maliciously crafted webpage. Affected platforms include Safari, iOS, iPadOS, and macOS Tahoe, all prior to version 26.5.2. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog; impact is limited to availability (process crash) with no confirmed confidentiality or integrity exposure.
Use-after-free memory corruption in Apple's WebKit browser engine causes an unexpected process crash when rendering maliciously crafted web content. Safari (all versions prior to 26.5.2), iOS and iPadOS (all versions prior to 26.5.2), and macOS Tahoe (all versions prior to 26.5.2) are affected across Apple's full consumer device ecosystem. No public exploit or CISA KEV listing exists at time of analysis; impact is confirmed as denial-of-service (process crash) only, with no confidentiality or integrity compromise.