Live › vulnerability › CVE-2026-113952
Go to dashboardA logic flaw in Safari and other Apple browsers let a website use a media format that Lockdown Mode should block. The sources do not describe code execution or data theft beyond that.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:20 UTC. All times on this page are UTC.
Apple device users whose browser runs on the affected versions, most relevant for people who rely on Lockdown Mode for protection. Server teams running no Apple browsers can skip it. The sources do not describe a specific server-side exposure.
No product ranges from the sources yet.
27.2, or iOS and iPadOS to 26.7.2 or 27.2, or macOS to 27.2 (Golden Gate).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A logic issue was addressed with improved checks. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2. A website may be able to use a media format that should be restricted in Lockdown Mode.
This page as .md · .json · in your agent: get_signal("CVE-2026-113952")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.