---
id: "CVE-2026-86922"
kind: "vulnerability"
aliases: ["CVE-2026-86922"]
title: "Safari and Apple OS: type confusion lets web content run code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["ios", "ipados", "macos", "other", "safari", "visionos"]
not_affected_if: []
published_at: "2026-10-20T01:17:27+00:00"
first_seen_at: "2026-10-23T21:57:19+00:00"
updated_at: "2026-10-23T22:32:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86922", "first_seen_at": "2026-10-23T21:57:19+00:00"}]
---

# Safari and Apple OS: type confusion lets web content run code

A type confusion bug in WebKit-based Safari and Apple operating systems lets a malicious web page run arbitrary code. The fix is in Safari 27, iOS 27, iPadOS 27, macOS Golden Gate 27 and visionOS 27.

_Summary, check and fix written by a model from the sources; labelled as such._

## Fix

Update Safari to 27, and iOS, iPadOS, macOS Golden Gate and visionOS to 27 or later.

## Timeline

- 2026-10-23T21:57:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-86922

## From the sources

A type confusion issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Processing maliciously crafted web content may lead to arbitrary code execution.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_