Live › vulnerability › CVE-2026-112690
Go to dashboardApple patched an input validation flaw in its operating systems that lets a remote attacker break out of the WebContent sandbox used by Safari and other WebKit-based views. The sources do not give a CVSS score or say whether the flaw is exploited.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:20 UTC. All times on this page are UTC.
Any Apple device running a version older than the fixed releases is exposed, since the flaw is in the operating system rather than an app. The sources do not say which WebKit component or configuration is needed, so unknown whether managed or non-default setups differ. Devices already on the fixed versions are not affected.
No product ranges from the sources yet.
sw_vers on macOS) and compare it to the fixed releases.26.7.2 or 27.2.26.7.2, macOS Sequoia to 15.8.2, and macOS Golden Gate to 27.2.27.2.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
This issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. A remote attacker may be able to break out of the WebContent sandbox.
This page as .md · .json · in your agent: get_signal("CVE-2026-112690")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.