Apple Safari: Use-after-free in WebKit allows code execution
Summary
A use-after-free vulnerability in WebKit, the browser engine behind Safari and other browsers on Apple devices, allows arbitrary code execution. An attacker can exploit it by getting a user to open crafted web content, for example through a malicious link. The CVSS 3.1 base score is 8.8 (High), and no privileges are required.
Affected
- Safari before 27.2
- iOS and iPadOS before 26.7.2 and before 27.2
- macOS, tvOS, visionOS and watchOS before 27.2
- Exact macOS build numbers for older macOS branches: Unknown.
Fixed in
- Safari 27.2
- iOS 26.7.2 and iPadOS 26.7.2
- iOS 27.2 and iPadOS 27.2
- macOS Golden Gate 27.2
- tvOS 27.2, visionOS 27.2, watchOS 27.2
Workaround
Unknown. No documented workaround; apply the software update.
Exploitation
- Apple has not reported active exploitation.
- Not listed in the CISA KEV catalogue.
- CISA SSVC: exploitation none, not automatable, total technical impact.
- EPSS is below 1%.
- No public proof of concept found in our searches; this is not conclusive.
Our recommendation
- Update Safari, iOS, iPadOS, macOS and other Apple devices to the fixed versions listed above, prioritising mobile devices and Macs used for browsing or mail.
- Check whether iOS 18.7.x or older macOS branches are affected by checking Apple's security releases page.
- Make sure devices that cannot be updated are not used for untrusted browsing.
- Monitor for reports of active exploitation.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apple Security Content: Safari 27.2 support.apple.com
- Apple Security Content: iOS 27.2 and iPadOS 27.2 support.apple.com
- Apple Security Content: iOS 26.7.2 and iPadOS 26.7.2 support.apple.com
- Apple Security Releases support.apple.com
- OpenCVE: CVE-2026-112626 app.opencve.io
- Strix: CVE-2026-112626 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:28.
Original description (NVD)
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.