Live › vulnerability › CVE-2026-112640
Go to dashboardA use-after-free bug in Apple's WebKit-based browser engine lets maliciously crafted web content corrupt memory. Memory corruption from web content can be used to run attacker code in the browser process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:20 UTC. All times on this page are UTC.
Any Apple device running the listed versions is affected, since any app that renders web content with WebKit can be fed the crafted page. Fleets of Apple devices and teams with Apple-based kiosks or browsers should patch. Devices already on the fixed builds are not affected.
No product ranges from the sources yet.
27.2, iOS and iPadOS 26.7.2 or 27.2, macOS 27.2, tvOS, visionOS and watchOS 27.227.2 or later26.7.2 or 27.2, macOS to 27.2, tvOS, visionOS and watchOS to 27.2Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to memory corruption.
This page as .md · .json · in your agent: get_signal("CVE-2026-112640")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.