Apple Safari & WebKit Security Update: CVEs for RCE, LPE, Info Disclosure

Security Summary for Safari 26.6 Vulnerability Overview Safari 26.6 was released on July 27, 2026, for macOS Sonoma and macOS Sequoia. It primarily addresses multiple security vulnerabilities, including sensitive data access, memory leaks, UI spoofing, iframe sandbox policy violations, unexpected crashes, and file read permission issues. Impact Scope Safari: The application may access sensitive user data. WebKit: - Maliciously crafted web content may cause process memory leaks. - Websites may be able to determine if a user has visited specific links. - Visiting websites containing malicious content may lead to UI spoofing. - Maliciously crafted web content may violate iframe sandbox policies. - Maliciously crafted web content may cause unexpected Safari crashes. - Applications may read files outside the sandbox. - Maliciously crafted web content may cause unexpected Safari crashes. - Maliciously crafted web content may cause unexpected Safari crashes. - Maliciously crafted web content may cause unexpected Safari crashes. Remediation Safari: Authorization issues were resolved by improving state management. WebKit: - Memory leaks were resolved by improving memory handling. - Link access issues were resolved by improving checks. - UI spoofing issues were resolved by improving the UI. - iframe sandbox policy violations were resolved by improving validation. - Unexpected crashes were resolved by improving memory management. - Unexpected crashes were resolved by improving state management. - Unexpected crashes were resolved by improving state management. - File read permission issues were resolved by improving access restrictions. - Unexpected crashes were resolved by improving memory management. - Unexpected crashes were resolved by improving boundary checks. Additional Acknowledgments Thanks to the following researchers and teams for their contributions: - Safari Downloads: Alfaz Hossain - WebKit: Jaya Surya Komireddy, Lukas Knittel, Nikos Fanourakis, Sotiris Ioannidis, Panagiotis Ili, Kostas Drakonis, Tony Gerez, Vitaliy Simonovich, Youngjoon Kim, s3zer0 - WebKit Canvas: Codex Security, Khai Tran, Daisuke Hatakeyama, Ryohei Ueki, David Bors, Giovanni Vignone, Robert van Eijk, Kwak Kiyong, Song nuri, Luat Nguyen, Tom Van Goethem, dr3dd - WebKit Storage: Gurpreet Shergill, Luke Francis, Milad Nasr, Nicholas Carlini, Claude, Anthropic, Olek Konko, Vitaliy Simonovich Release Date July 27, 2026 --- Key Vulnerability Details 1. CVE-2026-43792 - Impact: The application may access sensitive user data. - Fix: Authorization issues were resolved by improving state management. - Contributors: Ilya Andr (andr3dv) 2. CVE-2026-43740 - Impact: Maliciously crafted web content may cause process memory leaks. - Fix: Memory leaks were resolved by improving memory handling. - Contributors: Arni Hardarson, Nathaniel Oh (@calyateon) 3. CVE-2026-64713 - Impact: Websites may be able to determine if a user has visited specific links. - Fix: Link access issues were resolved by improving checks. - Contributors: Kwak Kiyong, Song Nuri 4. CVE-2026-64730 - Impact: Visiting websites containing malicious content may lead to UI spoofing. - Fix: UI spoofing issues were resolved by improving the UI. - Contributors: Kagami Rosylight of Mozilla 5. CVE-2026-64728 - Impact: Maliciously crafted web content may violate iframe sandbox policies. - Fix: iframe sandbox policy violations were resolved by improving validation. - Contributors: an anonymous researcher 6. CVE-2026-64783 - Impact: Maliciously crafted web content may cause unexpected Safari crashes. - Fix: Unexpected crashes were resolved by improving memory management. - Contributors: Sota Sugiyama, latte, Behzad Najarpour Jabbari (@_G4ru_), Junyeong Lee, Mooth.ai, OGINOME Tomohito, Using GLM From Z.AI, Gia Bul (@yabeow) from Calif.io 7. CVE-2026-64757 - Impact: Maliciously crafted web content may cause unexpected Safari crashes. - Fix: Unexpected crashes were resolved by improving state management. - Contributors: Milad Nasr and Nicholas Carlini with Claude, Anthropic 8. CVE-2026-43804 - Impact: Visiting websites may cause the application to reject service. - Fix: Unexpected crashes were resolved by improving state management. - Contributors: Heiko Kiesel of SEEMO, TU Darmstadt 9. CVE-2026-43821 - Impact: The application may read files outside the sandbox. - Fix: File read permission issues were resolved by improving access restrictions. - Contributors: Brian Carpenter 10. CVE-2026-64718 - Impact: Maliciously crafted web content may cause unexpected Safari crashes. - Fix: Unexpected crashes were resolved by improving memory management. - Contributors: OGINOME Tomohito, an anonymous researcher 11. CVE-2026-64719 - Impact: Maliciously crafted web content may cause unexpected Safari crashes. - Fix: Unexpected crashes were resolved by improving boundary checks. - Contributors: Shaheen Fazim --- Summary Safari 26.6 addresses multiple security vulnerabilities, primarily involving memory management,

Goal Reached Thanks to every supporter — we hit 100%!

Apple Safari & WebKit Security Update: CVEs for RCE, LPE, Info Disclosure

More from this source