--- id: "CVE-2026-84518" page: "https://infrastack.ai/live/CVE-2026-84518" kind: "vulnerability" aliases: ["CVE-2026-84518"] title: "This issue was addressed through improved state management" severity: "medium" cvss: 4.3 epss: null exploited: false status: "open" category: "other" products: [{"name": "apple safari", "fixed": ["27.0"], "affected": "< 27.0", "ecosystem": "vendor"}, {"name": "apple ipados", "fixed": ["27.0"], "affected": "< 27.0", "ecosystem": "vendor"}, {"name": "apple iphone os", "fixed": ["27.0"], "affected": "< 27.0", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["27.0"], "affected": "< 27.0", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["apple", "macos", "other", "safari", "vendor-advisory"] not_affected_if: ["other-browsers", "other-macos-versions"] published_at: "2026-09-14T21:17:28+00:00" first_seen_at: "2026-11-10T00:17:06+00:00" updated_at: "2026-11-10T00:28:45+00:00" sources: [{"source": "lab", "url": "https://support.apple.com/en-us/149039", "first_seen_at": "2026-11-10T00:17:06+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84518", "first_seen_at": "2026-11-10T00:28:45+00:00"}] exploit_sources: [] --- # This issue was addressed through improved state management Link for people: https://infrastack.ai/live/CVE-2026-84518 (this .md is for agents) Apple's Safari 27 update fixes a flaw in Safari that lets a malicious website determine which apps are installed on a Mac. The advisory lists no exploitation and gives no details beyond this impact. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:apple safari affected < 27.0 fixed 27.0 - vendor:apple ipados affected < 27.0 fixed 27.0 - vendor:apple iphone os affected < 27.0 fixed 27.0 - vendor:apple macos affected < 27.0 fixed 27.0 ## Fix - Safari 27 (released September 14, 2026) for macOS Sequoia and macOS Tahoe ## Timeline - 2026-11-10T00:17:06+00:00 lab https://support.apple.com/en-us/149039 — Apple: About the security content of Safari 27 - Apple Support - 2026-11-10T00:28:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-84518 ## Documents - [advisory] Apple: About the security content of iOS 27 and iPadOS 27 - Apple Support https://support.apple.com/en-us/149034 - [advisory] Apple: About the security content of macOS Golden Gate 27 - Apple Support https://support.apple.com/en-us/149035 - [advisory] Apple: About the security content of Safari 27 - Apple Support https://support.apple.com/en-us/149039 - [mentions] Apple: About the security content of Safari 27 - Apple Support https://support.apple.com/en-us/149039 ## From the sources About the security content of Safari 27 - Apple Support # About the security content of Safari 27 This document describes the security content of Safari 27. ## About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page. Apple security documents reference vulnerabilities by CVE-ID when possible. For more information about security, see the Apple Product Security page. ## Safari 27 Released September 14, 2026 ### Safari Available for: macOS Sequoia and macOS Tahoe Impact: A malicious website may be able to determine what apps a user has installed Description: This issue was addressed through improved state management. CVE-2026-84518: Bálint Magyar (balintmagyar.com) ### Safe Browsing Available for: macOS Sequoia and macOS Tahoe Impact: An app may be able to access sensitive user data Description: This issue was addressed with additional entitlement checks. CVE-2026-86897: Stuart Wallace ### WebKit Available for: macOS Sequoia and macOS Tahoe Impact: Processing maliciously crafted web content may lead to an unexpected process termination Description: A logic issue was addressed with improved state management. WebKit Bugzilla: 310457 CVE-2026-84635: Souta Sugiyama ### WebKit Available for: macOS Sequoia and macOS Tahoe Impact: Processing maliciously crafted web content may disclose sensitive user information Description: A permissions issue was addressed by removing the vulnerable code. WebKit Bugzilla: 315121 CVE-2026-64753: Viggo Lekdorf ### WebKit Available for: macOS Sequoia and macOS Tahoe Impact: Opening a maliciously crafted webarchive file may lead to universal cross-site scripting Description: A logic issue was addressed with improved state management. WebKit Bugzilla: 318271 CVE-2026-86898: Tomi Garcia (archyxsec) ### WebKit Available for: macOS Sequoia and macOS Tahoe Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A type confusion issue was addressed with improved state management. WebKit Bugzilla: 308231 CVE-2026-86922: Nathaniel Oh (@calysteon), Kwak Kiyong / kakaogames Entry added October 19, 2026 ### WebKit Available for: macOS Sequoia and macOS Tahoe Impact: Processing maliciously crafted web content may lead to unexpected behavior Description: A logic issue was addressed with improved state management. WebKit Bugzilla: 318807 CVE-2026-86872: Junhyuk Im of S2W Inc, Seungyun Lee of S2W Inc Entry added October 19, 2026 ### WebKit Canvas Available for: macOS Sequoia and macOS Tahoe Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 313935 CVE-2026-64718: Niels Hofmans, OGINOME Tomohito, an anonymous researcher ## Additional recognition ### Safari We would like to acknowledge Dem0ns @天府简易信工作室 for their assistance. ### Safari Downloads We would like to acknowledge Barath Stalin K (linkedin.com/in/barathstalin), Exell Nakano, Manojkumar Jaganathan (linkedin.com/in/manojkumar-j-7ba35b202/) with HackerBro Technologies, Praditya Fajar Ramadhan, Zhiyang Zeng (@Wester), shobhit srivastav for their assistance. ### WebKit We would like to acknowledge @TristanInSec, Behzad Najjarpour Jabbari (@_G4ru_), Big Bear, Eddy Tsalolikhin, Henock Habte, Kenneth Hsu, Maher Azzouzi, Meridian Miftari, N13S, OpenAI Codex Security - Amy Burnett, Souta Sugiyama, Vitaly Simonovich, an anonymous researcher, hamayanhamayan, lattice, lebr0nli of National Yang Ming Chiao Tung University, Security and Systems Lab, ret2happy, wwwlk, and Qadhafy Muhammad Tera for their assistance. Entry updated October 19, 2026 ### WebKit Canvas We would like to acknowledge Utkarsh Pal for their assistance. ### WebKit JavaScript Bindings We would like to acknowledge hamayanhamayan for their assistance. Published Date: October 19, 2026 --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_