Live › vulnerability › CVE-2026-113901
Go to dashboardA use-after-free memory bug in Safari and several Apple operating systems can be triggered by maliciously crafted web content. The sources say it can crash the browser process, and they do not describe code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:20 UTC. All times on this page are UTC.
Anyone who browses the web with Safari or a device running the listed Apple OS versions is in scope, since the trigger is web content. Teams running fleets of Apple devices should treat it as a routine update. The sources do not say whether third-party browsers or WebKit-based apps are affected.
No product ranges from the sources yet.
27.2 or later.27.2 or later, macOS Golden Gate to 27.2 or later, and visionOS to 27.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to an unexpected process crash.
This page as .md · .json · in your agent: get_signal("CVE-2026-113901")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.