5.4
Medium
CVE-2026-86898 A logic issue was addressed with improved state management
Description
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening a maliciously crafted webarchive file may lead to universal cross-site scripting.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Safari 27 | earliest → < 27 | 27 |
| iOS and iPadOS 27 | earliest → < 27 | 27 |
| macOS 27 | earliest → < 27 | 27 |
| visionOS 27 | earliest → < 27 | 27 |
References
- support.apple.com support.apple.com
- support.apple.com support.apple.com
- support.apple.com support.apple.com
- support.apple.com support.apple.com
Timeline
- Published
- Last modified
Other CVEs of Safari
The 520 CVEs of Safari →
CVE-2026-113904
A use-after-free issue was addressed with improved memory management
4.3
Medium
CVE-2026-113949
A type confusion issue was addressed with improved state management
8.8
High
CVE-2026-112621
An out-of-bounds write issue was addressed with improved bounds checking
7.5
High
CVE-2026-112699
An out-of-bounds read was addressed with improved bounds checking
6.5
Medium