Live › vulnerability › CVE-2026-113897
Go to dashboardA flaw in Safari's Web Content process lets a remote attacker break out of the browser sandbox. Apple fixed it by removing the vulnerable code in Safari 27.2, iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2 and visionOS 27.2.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:20 UTC. All times on this page are UTC.
Anyone running an Apple browser or OS build older than 27.2 is exposed when they open untrusted web content. The sources do not say which configurations are most at risk. Teams that only run fully patched 27.2 or later builds can skip it.
No product ranges from the sources yet.
sw_vers on macOS to see the OS build27.2 or later27.2 or later27.2 or later27.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
This issue was addressed by removing the vulnerable code. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. A remote attacker may be able to break out of Web Content sandbox.
This page as .md · .json · in your agent: get_signal("CVE-2026-113897")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.