Apple WebKit: Arbitrary code execution via type confusion in web content

Summary

A type confusion flaw in WebKit, the browser engine used by Safari and in-app browsers on Apple platforms, affects Safari, iOS, iPadOS, macOS and visionOS before version 27. An attacker who gets a user to process maliciously crafted web content may be able to execute arbitrary code. No user privileges are needed, but the victim must interact with the content. No exploitation in the wild or public proof of concept has been reported.

Affected

• Safari versions before 27
• iOS and iPadOS versions before 27
• macOS versions before 27 (macOS Golden Gate 27 line)
• visionOS versions before 27
• Red Hat also tracks a WebKitGTK component of the same issue; RHEL 6 and 7 are listed as affected (snapshot, may be outdated)

Fixed in

• Safari 27, iOS 27, iPadOS 27, macOS Golden Gate 27 and visionOS 27 or later
• Exact fixed build numbers: Unknown. Verify in the Apple security advisories before reporting a patch level.

Workaround

Unknown. Apple has not published a workaround in the sources reviewed. Patching is the fix.

Exploitation

• No evidence of exploitation in the wild found
• Not listed in CISA KEV according to Strix
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total
• No public proof of concept found
• EPSS is low (about 0.00335)

Our recommendation

• Update Safari, iOS, iPadOS, macOS and visionOS to version 27 or later on all managed devices
• Prioritise devices used for browsing, and track Mac Safari and iOS as separate inventory records
• Where patching is delayed, limit browsing of untrusted sites on unpatched devices; consider Lockdown Mode for high-risk users
• Check Linux systems running WebKitGTK-based applications and apply vendor updates there
• Monitor for exploitation reports, as NVD analysis was still pending

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Apple security content of iOS 27 and iPadOS 27 support.apple.com
• Apple security content of macOS Golden Gate 27 support.apple.com
• Apple security content of Safari 27 support.apple.com
• GitHub Advisory GHSA-gm6q-c5mj-f444 github.com
• Strix CVE record CVE-2026-86922 www.strix.ai
• OpenCVE CVE-2026-86922 app.opencve.io
• VulDB exploit estimate 422626 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 15:40.