Apple Safari/WebKit: Use-after-free allows arbitrary code execution
Summary
Apple Safari and WebKit-based components on iOS, iPadOS, macOS and visionOS contain a use-after-free memory issue. An attacker can run arbitrary code by sending crafted web content that the victim opens. The attack needs no privileges, but a user must act, typically by visiting a malicious page.
Affected
- Safari before 27.2
- iOS and iPadOS before 26.7.2 and before 27.2
- macOS before 27.2 (macOS Golden Gate)
- visionOS before 27.2
Fixed in
- Safari 27.2
- iOS 26.7.2 and iPadOS 26.7.2
- iOS 27.2 and iPadOS 27.2
- macOS Golden Gate 27.2
- visionOS 27.2
Workaround
Unknown.
Exploitation
- Not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable no.
- EPSS below 1%.
- Apple advisories reviewed do not flag this issue as exploited in the wild.
- No public proof of concept found.
Our recommendation
- Update Safari and all Apple devices to the fixed versions without delay, prioritising devices used for web browsing.
- Check the Apple advisories for each product to confirm the fixed build.
- Monitor for new Apple security releases and known exploitation reports.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apple Safari 27.2 security content support.apple.com
- Apple iOS 26.7.2 security content support.apple.com
- OpenCVE CVE-2026-112651 app.opencve.io
- Tenable plugin 372124 www.tenable.com
- Strix CVE-2026-112651 www.strix.ai
- MacRumors: iOS 27.2 security fixes www.macrumors.com
- TechRepublic: iOS 27.2 security flaws patched www.techrepublic.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:26.
Original description (NVD)
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.