{"id":"CVE-2026-113913","kind":"vulnerability","aliases":["CVE-2026-113913"],"related":[],"title":"Apple iOS and macOS: input validation flaw leaks sensitive data via web content","description":"An input validation issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing web content may disclose sensitive information.","summary":"A missing input check in Apple's WebKit-based web content handling lets crafted web content disclose sensitive information. The fix ships in iOS 26.7.2, iPadOS 26.7.2, iOS 27.2, iPadOS 27.2, macOS Tahoe 26.7.2, macOS Sequoia 15.8.2, macOS Golden Gate 27.2 and visionOS 27.2.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple","infrastructure","ios","ipados","macos","safari","visionos"],"not_affected_if":["already-patched"],"how_to_check":"- Check the device version under Settings > General > About (iOS, iPadOS, visionOS) or run `sw_vers` on macOS\n- Compare against the fixed versions listed above; anything older is exposed","fix":"- Update iOS and iPadOS to `26.7.2` or `27.2`\n- Update macOS Tahoe to `26.7.2`, macOS Sequoia to `15.8.2`, or macOS Golden Gate to `27.2`\n- Update visionOS to `27.2`","status":"open","published_at":"2026-10-26T21:18:08+00:00","first_seen_at":"2026-10-26T21:20:31+00:00","triaged_at":"2026-10-26T21:21:54+00:00","updated_at":"2026-10-26T21:21:54+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-26T21:21:54Z","model":"claude-haiku-5-5","output":{"fix":"- Update iOS and iPadOS to `26.7.2` or `27.2`\n- Update macOS Tahoe to `26.7.2`, macOS Sequoia to `15.8.2`, or macOS Golden Gate to `27.2`\n- Update visionOS to `27.2`","reach":"internet","title":"Apple iOS and macOS: input validation flaw leaks sensitive data via web content","impact":"low","summary":"A missing input check in Apple's WebKit-based web content handling lets crafted web content disclose sensitive information. The fix ships in iOS 26.7.2, iPadOS 26.7.2, iOS 27.2, iPadOS 27.2, macOS Tahoe 26.7.2, macOS Sequoia 15.8.2, macOS Golden Gate 27.2 and visionOS 27.2.","category":"infrastructure","nicknames":[],"who_cares":["apple","ios","macos","ipados","visionos","safari"],"confidence":0.4,"needs_auth":"no","worst_case":"Sensitive information disclosed from processed web content","analyst_note":"Sources give no CVSS, affected component or detail on what data leaks; check Apple's security release notes for the component and the data disclosed.","how_to_check":"- Check the device version under Settings > General > About (iOS, iPadOS, visionOS) or run `sw_vers` on macOS\n- Compare against the fixed versions listed above; anything older is exposed","needs_analyst":true,"not_affected_if":["already-patched"],"who_is_affected":"Anyone running an Apple device or Mac on an OS version older than the fixed releases, when browsing or otherwise processing web content. Managed fleets should confirm update status; devices already on the fixed versions are not affected. The sources do not say whether any specific browser or app configuration changes exposure.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000665,"input_tokens":3323,"output_tokens":665,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-113913':16A,19A '-2026':15A,18A '15.8.2':64B,103C '26.7.2':52B,54B,61B,88C,91C,106C '27.2':56B,58B,68B,71B,93C,96C,100C,108C 'address':77C 'appl':1A,20B,32B 'base':36B 'check':30B 'content':13A,38B,43B,111C 'craft':41B 'cve':14A,17A 'data':10A 'disclos':44B,113C 'fix':48B,85C 'flaw':7A 'gate':67B,99C 'golden':66B,98C 'handl':39B 'improv':79C 'inform':46B,115C 'infrastructur':21B 'input':5A,29B,73C,80C 'io':2A,22B,51B,55B,87C,92C 'ipado':23B,53B,57B,90C,95C 'issu':75C,83C 'leak':8A 'let':40B 'maco':4A,24B,59B,62B,65B,97C,101C,104C 'may':112C 'miss':28B 'process':109C 'safari':25B 'sensit':9A,45B,114C 'sequoia':63B,102C 'ship':49B 'taho':60B,105C 'valid':6A,74C,81C 'via':11A 'visiono':26B,70B,107C 'web':12A,37B,42B,110C 'webkit':35B 'webkit-bas':34B","nicknames":[],"mitigations":[],"who_affected":"Anyone running an Apple device or Mac on an OS version older than the fixed releases, when browsing or otherwise processing web content. Managed fleets should confirm update status; devices already on the fixed versions are not affected. The sources do not say whether any specific browser or app configuration changes exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:18:08+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113913","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113913","severity":null,"published_at":"2026-10-26T21:18:08+00:00","modified_at":"2026-10-26T21:18:08+00:00","first_seen_at":"2026-10-26T21:20:31+00:00","fetched_at":"2026-10-26T21:20:31+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}