{"id":"CVE-2026-86922","kind":"vulnerability","aliases":["CVE-2026-86922"],"related":[],"title":"Safari and Apple OS: type confusion lets web content run code","description":"A type confusion issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Processing maliciously crafted web content may lead to arbitrary code execution.","summary":"A type confusion bug in WebKit-based Safari and Apple operating systems lets a malicious web page run arbitrary code. The fix is in Safari 27, iOS 27, iPadOS 27, macOS Golden Gate 27 and visionOS 27.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ios","ipados","macos","other","safari","visionos"],"not_affected_if":[],"how_to_check":null,"fix":"Update Safari to 27, and iOS, iPadOS, macOS Golden Gate and visionOS to 27 or later.","status":"open","published_at":"2026-10-20T01:17:27+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-23T22:32:54+00:00","updated_at":"2026-10-23T22:32:54+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-23T22:32:54Z","model":"claude-haiku-5-5","output":{"fix":"Update Safari to 27, and iOS, iPadOS, macOS Golden Gate and visionOS to 27 or later.","reach":"internet","title":"Safari and Apple OS: type confusion lets web content run code","impact":"high","summary":"A type confusion bug in WebKit-based Safari and Apple operating systems lets a malicious web page run arbitrary code. The fix is in Safari 27, iOS 27, iPadOS 27, macOS Golden Gate 27 and visionOS 27.","category":"other","who_cares":["safari","ios","ipados","macos","visionos"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs arbitrary code after the user visits a crafted page.","analyst_note":"","how_to_check":"unknown","needs_analyst":false,"not_affected_if":[],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000453,"input_tokens":2879,"output_tokens":330,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-86922':14A,17A '27':50B,52B,54B,58B,61B,78C,80C,83C,87C,89C 'address':67C 'appl':3A,34B 'arbitrari':43B,98C 'base':31B 'bug':27B 'code':11A,44B,99C 'confus':6A,26B,64C 'content':9A,94C 'craft':92C 'cve':12A,15A 'execut':100C 'fix':46B,75C 'gate':57B,86C 'golden':56B,85C 'improv':69C 'io':18B,51B,79C 'ipado':19B,53B,82C 'issu':65C,73C 'lead':96C 'let':7A,37B 'maco':20B,55B,84C 'malici':39B,91C 'manag':71C 'may':95C 'oper':35B 'os':4A 'page':41B 'process':90C 'run':10A,42B 'safari':1A,22B,32B,49B,77C 'state':70C 'system':36B 'type':5A,25B,63C 'visiono':23B,60B,88C 'web':8A,40B,93C 'webkit':30B 'webkit-bas':29B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T01:17:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86922","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86922","severity":null,"published_at":"2026-10-20T01:17:27+00:00","modified_at":"2026-10-21T04:18:11+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}