{"id":"CVE-2026-113952","kind":"vulnerability","aliases":["CVE-2026-113952"],"related":[],"title":"Safari: a logic flaw lets a website use a Lockdown Mode-restricted media format","description":"A logic issue was addressed with improved checks. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2. A website may be able to use a media format that should be restricted in Lockdown Mode.","summary":"A logic flaw in Safari and other Apple browsers let a website use a media format that Lockdown Mode should block. The sources do not describe code execution or data theft beyond that.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ios","ipados","lockdown-mode","macos","runtime","safari"],"not_affected_if":["patched-versions"],"how_to_check":"- Check the Safari version under Safari > About Safari, and the iOS/iPadOS/macOS version under Settings > General > About.\n- Check whether Lockdown Mode is enabled under Settings > Privacy & Security > Lockdown Mode.","fix":"- Update Safari to `27.2`, or iOS and iPadOS to `26.7.2` or `27.2`, or macOS to `27.2` (Golden Gate).","status":"open","published_at":"2026-10-26T21:18:11+00:00","first_seen_at":"2026-10-26T21:20:31+00:00","triaged_at":"2026-10-26T21:21:34+00:00","updated_at":"2026-10-26T21:21:34+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-26T21:21:34Z","model":"claude-haiku-5-5","output":{"fix":"- Update Safari to `27.2`, or iOS and iPadOS to `26.7.2` or `27.2`, or macOS to `27.2` (Golden Gate).","reach":"internet","title":"Safari: a logic flaw lets a website use a Lockdown Mode-restricted media format","impact":"low","summary":"A logic flaw in Safari and other Apple browsers let a website use a media format that Lockdown Mode should block. The sources do not describe code execution or data theft beyond that.","category":"runtime","nicknames":[],"who_cares":["safari","ios","ipados","macos","lockdown-mode"],"confidence":0.5,"needs_auth":"no","worst_case":"A malicious website bypasses a Lockdown Mode media restriction in the browser.","analyst_note":"","how_to_check":"- Check the Safari version under Safari > About Safari, and the iOS/iPadOS/macOS version under Settings > General > About.\n- Check whether Lockdown Mode is enabled under Settings > Privacy & Security > Lockdown Mode.","needs_analyst":false,"not_affected_if":["patched-versions"],"who_is_affected":"Apple device users whose browser runs on the affected versions, most relevant for people who rely on Lockdown Mode for protection. Server teams running no Apple browsers can skip it. The sources do not describe a specific server-side exposure.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000586,"input_tokens":3299,"output_tokens":512,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-113952':18A,21A '-2026':17A,20A '26.7.2':78C,81C '27.2':76C,83C,86C,90C 'abl':95C 'address':66C 'appl':37B 'beyond':61B 'block':50B 'browser':38B 'check':69C 'code':56B 'cve':16A,19A 'data':59B 'describ':55B 'execut':57B 'fix':73C 'flaw':4A,32B 'format':15A,45B,100C 'gate':89C 'golden':88C 'improv':68C 'io':22B,77C,82C 'ipado':23B,80C,85C 'issu':64C,71C 'let':5A,39B 'lockdown':10A,25B,47B,106C 'lockdown-mod':24B 'logic':3A,31B,63C 'maco':27B,87C 'may':93C 'media':14A,44B,99C 'mode':12A,26B,48B,107C 'mode-restrict':11A 'restrict':13A,104C 'runtim':28B 'safari':1A,29B,34B,75C 'sourc':52B 'theft':60B 'use':8A,42B,97C 'websit':7A,41B,92C","nicknames":[],"mitigations":[],"who_affected":"Apple device users whose browser runs on the affected versions, most relevant for people who rely on Lockdown Mode for protection. Server teams running no Apple browsers can skip it. The sources do not describe a specific server-side exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:18:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113952","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113952","severity":null,"published_at":"2026-10-26T21:18:11+00:00","modified_at":"2026-10-26T21:18:11+00:00","first_seen_at":"2026-10-26T21:20:31+00:00","fetched_at":"2026-10-26T21:20:31+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}