Vulnerability in Apple Safari

[ Why it matters ]Priority signals

• Critical severity: CVSS 10.0

[ Description ]Official description

This issue was addressed by removing the vulnerable code. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. A remote attacker may be able to break out of Web Content sandbox.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• NCSC-NL27 Oct 2026NCSC-2026-0456

  Vulnerabilities fixed in Apple iOS and iPadOS Translated from Dutch

  Probability/damage M/HCVE-2019-5598CVE-2022-26704CVE-2026-28864+177 more CVEs
• NCSC-NL27 Oct 2026NCSC-2026-0455

  Vulnerabilities fixed in Apple MacOS Translated from Dutch

  Probability/damage M/HCVE-2022-26704CVE-2026-20648CVE-2026-20649+296 more CVEs
• CERT-FR27 Oct 2026CERTFR-2026-AVI-1387

  Multiple vulnerabilities in Apple products Translated from French

  Multiple vulnerabilities have been discovered in Apple products. Some of them allow an attacker to cause arbitrary code execution, privilege escalation and a breach of data confidentiality. Apple reports that…

  CVE-2026-112483CVE-2026-112566CVE-2026-84539+326 more CVEs
• BSI CERT-Bund26 Oct 2026WID-SEC-2026-4165

  Apple iOS, iPadOS, macOS and Safari: Multiple vulnerabilities Translated from German

  CVE-2026-112442CVE-2026-112684CVE-2026-112563+325 more CVEs

[ References ]References

• support.apple.com/en-us/149230Vendor Advisory
• support.apple.com/en-us/149521Vendor Advisory
• support.apple.com/en-us/149526Vendor Advisory
• support.apple.com/en-us/149527Vendor Advisory