Apple WebKit: Type confusion allows arbitrary code execution via web content
Summary
A type confusion flaw in WebKit, the browser engine used by Safari and most in-app browsers on Apple devices, affects Safari, iOS, iPadOS, macOS and visionOS before the fixed releases. An attacker can exploit it by getting a user to open a malicious web page, which may lead to arbitrary code execution. The CVSS score of 8.8 is taken from the provided CVE data; NVD analysis was still pending at the time of writing.
Affected
- Safari before 27.2
- iOS before 26.7.2 and iOS before 27.2
- iPadOS before 26.7.2 and iPadOS before 27.2
- macOS before Golden Gate 27.2
- visionOS before 27.2
- Exact build numbers: Unknown.
Fixed in
- Safari 27.2
- iOS 26.7.2 and iOS 27.2
- iPadOS 26.7.2 and iPadOS 27.2
- macOS Golden Gate 27.2
- visionOS 27.2
- A secondary source also lists macOS Tahoe 26.7.2 and macOS Sequoia 15.8.2; verify on Apple's security pages before relying on it.
Workaround
- No workaround is needed where the patched versions are installed.
- No vendor-documented mitigation for unpatched systems was found. Unknown.
Exploitation
- Apple does not report active exploitation.
- No public proof of concept found.
- Not listed in CISA KEV according to a third-party aggregator; verify directly at the CISA catalog.
Our recommendation
- Update Safari, iOS, iPadOS, macOS and visionOS to the fixed versions on all managed Apple devices.
- Verify that automatic updates are enabled and check each device, as Background Security Improvements may not cover this fix.
- Remind staff to avoid opening untrusted links.
- Re-check the NVD record and CISA KEV for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apple Security Content of iOS 26.7.2 and iPadOS 26.7.2 support.apple.com
- Apple Security Content of iOS 27.2 and iPadOS 27.2 support.apple.com
- Apple Security Content (macOS/visionOS advisory) support.apple.com
- Apple Security Content (advisory) support.apple.com
- Apple Security Content of Safari 27.2 support.apple.com
- Apple WebKit features for Safari 27.2 webkit.org
- Cybersecurity News: Apple iOS 27.2 released cybersecuritynews.com
- Strix CVE-2026-112659 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:26.
Original description (NVD)
A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.