Apple WebKit (Safari): Use-after-free allows arbitrary code execution
Summary
A use-after-free vulnerability in Apple's WebKit browser engine, which powers Safari and many in-app browsers, allows arbitrary code execution. An attacker can trigger it by getting a user to open a maliciously crafted web page, and no privileges are required. Apple fixed the issue in the 27.2 releases. NVD analysis was still pending at publication, and the CVSS 8.8 score comes from NVD data.
Affected
- Safari before 27.2
- iOS and iPadOS before 27.2
- macOS before Golden Gate 27.2 (macOS 27.2)
- tvOS, visionOS and watchOS before 27.2
Fixed in
- Safari 27.2
- iOS 27.2 and iPadOS 27.2
- macOS Golden Gate 27.2
- tvOS 27.2, visionOS 27.2 and watchOS 27.2
Workaround
Unknown. No vendor-documented workaround. Apply the patch.
Exploitation
- Apple has not reported exploitation.
- Not listed in CISA KEV (per third-party mirror).
- CNA SSVC data: Exploitation none, Automatable no.
- No public proof of concept found in our searches; this does not rule one out.
Our recommendation
- Update Safari and all Apple devices to the fixed versions above via Software Update.
- Prioritise iPhones, iPads and Macs used for browsing or for apps with embedded web views.
- Verify the component mapping in the Apple advisories before relying on it, because the CVE ID placement in the advisory text could not be fully confirmed.
- Monitor for Apple updates and for reports of exploitation.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apple Security Content of Safari 27.2 (WebKit) support.apple.com
- Apple Security Content of macOS Golden Gate 27.2 support.apple.com
- HKCERT security bulletin on Apple products www.hkcert.org
- OpenCVE entry for CVE-2026-112637 app.opencve.io
- Strix CVE entry for CVE-2026-112637 www.strix.ai
- Cybersecurity News: Apple iOS 27.2 released cybersecuritynews.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:27.
Original description (NVD)
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.