Live › vulnerability › CVE-2026-113949
Go to dashboardA type confusion flaw in WebKit-based Safari and Apple's operating systems can be triggered by maliciously crafted web content. The sources say it can lead to memory corruption, which an attacker could use to run code or crash the browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:20 UTC. All times on this page are UTC.
Anyone using Safari or the listed Apple OS versions who browses untrusted web content is exposed, since the flaw is triggered by crafted web pages. The sources do not name a specific configuration or role, so unknown whether any setting limits exposure. Teams that only run fixed, patched Apple devices can skip it.
No product ranges from the sources yet.
27.2 on macOS and visionOS26.7.2 or 27.227.2 (macOS Golden Gate)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A type confusion issue was addressed with improved state management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to memory corruption.
This page as .md · .json · in your agent: get_signal("CVE-2026-113949")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.