WebKit: Use-after-free in web content processing allows code execution

Summary

A use-after-free flaw in Apple's WebKit engine affects Safari and, through it, other browsers and in-app web views on Apple devices. According to the CVE record, processing maliciously crafted web content may lead to arbitrary code execution. Exploitation requires that a user visits a crafted page, and no authentication is needed.

Affected

• Safari below 27.2
• iOS and iPadOS below 26.7.2 and below 27.2
• macOS below 27.2
• visionOS below 27.2

Fixed in

• Safari 27.2
• iOS 26.7.2 and iPadOS 26.7.2
• iOS 27.2 and iPadOS 27.2
• macOS Golden Gate 27.2
• visionOS 27.2

Workaround

No official workaround from Apple. Install the patched release.

Exploitation

• Apple has not reported known active exploitation.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• EPSS below 1%.
• No public proof of concept found in our research.

Our recommendation

• Update Safari and all Apple devices (iOS, iPadOS, macOS, visionOS) to the fixed versions, prioritising browsing-heavy and BYOD devices.
• Enforce updates through MDM where possible and check which devices still run older versions.
• Until patched, limit browsing of untrusted websites on unpatched devices.
• Verify the exact fixed build numbers on Apple's security pages, as asset tools may report false results for 27.2 releases.
• Track the related WebKit sandbox escape CVE-2026-113897, fixed in the same release.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Apple security content Safari 27.2 support.apple.com
• Apple security content iOS 26.7.2 and iPadOS 26.7.2 support.apple.com
• Apple security content iOS 27.2 and iPadOS 27.2 support.apple.com
• OpenCVE CVE-2026-112623 app.opencve.io
• Strix CVE-2026-112623 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:27.