{"id":"CVE-2026-112626","kind":"vulnerability","aliases":["CVE-2026-112626"],"related":[],"title":"Apple Safari and iOS: use-after-free lets crafted web content run code","description":"A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.","summary":"A use-after-free memory bug in Apple's WebKit-based browser engine lets maliciously crafted web content trigger arbitrary code execution. The sources list fixed builds across Safari, iOS, iPadOS, macOS, tvOS, visionOS and watchOS.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple-devices","ios","ipados","macos","other","safari","tvos","visionos","watchos"],"not_affected_if":["already-patched-builds"],"how_to_check":"- Check the installed Safari or OS version under Settings > General > About (iOS/iPadOS) or About This Mac (macOS)\n- Compare against the fixed builds: Safari 27.2, iOS 26.7.2, iPadOS 26.7.2, iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2","fix":"- Update Safari to `27.2` or later\n- Update iOS and iPadOS to `26.7.2` or `27.2` as applicable\n- Update macOS Golden Gate, tvOS, visionOS and watchOS to `27.2`","status":"open","published_at":"2026-10-26T21:17:55+00:00","first_seen_at":"2026-10-26T21:20:29+00:00","triaged_at":"2026-10-26T21:25:15+00:00","updated_at":"2026-10-26T21:25:15+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-26T21:25:15Z","model":"claude-haiku-5-5","output":{"fix":"- Update Safari to `27.2` or later\n- Update iOS and iPadOS to `26.7.2` or `27.2` as applicable\n- Update macOS Golden Gate, tvOS, visionOS and watchOS to `27.2`","reach":"internet","title":"Apple Safari and iOS: use-after-free lets crafted web content run code","impact":"high","summary":"A use-after-free memory bug in Apple's WebKit-based browser engine lets maliciously crafted web content trigger arbitrary code execution. The sources list fixed builds across Safari, iOS, iPadOS, macOS, tvOS, visionOS and watchOS.","category":"other","nicknames":[],"who_cares":["safari","ios","ipados","macos","tvos","visionos","watchos","apple-devices"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs arbitrary code after the victim loads a crafted page","analyst_note":"Check Apple's security notes for the CVE to confirm exploitation status and which third-party WebKit browsers are affected.","how_to_check":"- Check the installed Safari or OS version under Settings > General > About (iOS/iPadOS) or About This Mac (macOS)\n- Compare against the fixed builds: Safari 27.2, iOS 26.7.2, iPadOS 26.7.2, iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2","needs_analyst":true,"not_affected_if":["already-patched-builds"],"who_is_affected":"Any device or Mac running Safari or a WebKit-based browser on an affected Apple OS build is exposed, because the bug is reached by loading web content. The sources do not say which browsers outside Safari share the flawed engine code, so unknown for third-party apps. Managed fleets should prioritise any device that browses untrusted sites.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000686,"input_tokens":3333,"output_tokens":705,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112626':17A,20A '-2026':16A,19A '26.7.2':90C,93C '27.2':88C,95C,98C,102C,104C,106C,108C 'across':61B 'address':77C 'appl':1A,22B,40B 'apple-devic':21B 'arbitrari':53B,117C 'base':44B 'browser':45B 'bug':38B 'build':60B 'code':14A,54B,118C 'content':12A,51B,113C 'craft':10A,49B,111C 'cve':15A,18A 'devic':23B 'engin':46B 'execut':55B,119C 'fix':59B,85C 'free':8A,36B,74C 'gate':101C 'golden':100C 'improv':79C 'io':4A,24B,63B,89C,94C 'ipado':25B,64B,92C,97C 'issu':75C,83C 'lead':115C 'let':9A,47B 'list':58B 'maco':26B,65B,99C 'malici':48B,110C 'manag':81C 'may':114C 'memori':37B,80C 'process':109C 'run':13A 'safari':2A,28B,62B,87C 'sourc':57B 'trigger':52B 'tvos':29B,66B,103C 'use':6A,34B,72C 'use-after-fre':5A,33B,71C 'visiono':30B,67B,105C 'watcho':31B,69B,107C 'web':11A,50B,112C 'webkit':43B 'webkit-bas':42B","nicknames":[],"mitigations":[],"who_affected":"Any device or Mac running Safari or a WebKit-based browser on an affected Apple OS build is exposed, because the bug is reached by loading web content. The sources do not say which browsers outside Safari share the flawed engine code, so unknown for third-party apps. Managed fleets should prioritise any device that browses untrusted sites.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:17:55+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112626","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112626","severity":null,"published_at":"2026-10-26T21:17:55+00:00","modified_at":"2026-10-26T21:17:55+00:00","first_seen_at":"2026-10-26T21:20:29+00:00","fetched_at":"2026-10-26T21:20:29+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}