Apple WebKit: Use-after-free allows arbitrary code execution via web content
Summary
A use-after-free flaw in Apple's WebKit engine affects Safari and other WebKit-based browsing on iOS, iPadOS, macOS, tvOS, visionOS and watchOS. An attacker can craft a malicious web page that may lead to arbitrary code execution when a user opens it. The attack requires the user to visit or interact with the malicious content.
Affected
- Safari before 27.2
- iOS and iPadOS before 26.7.2 and before 27.2
- macOS, tvOS, visionOS and watchOS before 27.2
- Linux WebKitGTK packages: Amazon Linux 2 webkitgtk4 fix pending, webkitgtk3 no fix planned (third-party data, not verified against Apple)
Fixed in
- Safari 27.2
- iOS 26.7.2 and iPadOS 26.7.2; iOS 27.2 and iPadOS 27.2
- macOS Golden Gate 27.2
- tvOS 27.2, visionOS 27.2, watchOS 27.2
- Exact build numbers: Unknown.
Workaround
- Unknown. No vendor workaround found; patching is the fix.
Exploitation
- Not listed in CISA's Known Exploited Vulnerabilities catalog at the time of the research.
- CISA SSVC data shows exploitation: none and not automatable.
- VulDB states no available exploit; no public proof of concept found.
Our recommendation
- Update Safari and all Apple devices (iPhone, iPad, Mac, Apple Watch, Vision Pro) to the fixed versions; enforce automatic updates or MDM enforcement.
- Prioritise devices used on the move and devices with in-app browsers based on WebKit.
- Check Linux systems for WebKitGTK packages and monitor for vendor fixes.
- Monitor for exploitation news and CISA KEV additions.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apple Safari 27.2 security content support.apple.com
- Apple iOS 27.2 and iPadOS 27.2 security content support.apple.com
- Apple iOS 26.7.2 and iPadOS 26.7.2 security content support.apple.com
- OpenCVE CVE-2026-112655 app.opencve.io
- VulDB CVE-2026-112655 vuldb.com
- SUSE CVE record via Vulners vulners.com
- Strix CVE-2026-112655 www.strix.ai
- Mallory: Amazon Linux WebKitGTK status mallory.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:25.
Original description (NVD)
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.