macOS Golden Gate 27.2
149521
Summary
No separate summary was provided in the collected bulletin.
View 23 component changes
LinkPresentation
Available for: macOS Sequoia and macOS Tahoe
Impact: Processing a maliciously crafted image may result in memory corruption
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-112621: Vinay Kumar Rasala (Xplo8E) from Appknox, an anonymous researcher
WebKit
Available for: macOS Sequoia and macOS Tahoe
Impact: Processing maliciously crafted web content may lead to an unexpected process crash
Description: A use-after-free issue was addressed with improved memory management.
CVE-2026-113904: Lily Cohl (@GenericCoding), Do Young Park (adawn), MYUNGYONG LEE, Luke Francis (@lukefr09), Shubham Chaskar, Kwak Kiyong, Song Nuri
CVE-2026-112599: Avinash Kumar Thapa & Jay Kaushik Patel
WebKit
Available for: macOS Sequoia and macOS Tahoe
Impact: Processing maliciously crafted web content may lead to memory corruption
Description: A type confusion issue was addressed with improved checks.
CVE-2026-86974: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative
WebKit
Available for: macOS Sequoia and macOS Tahoe
Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash
Description: A use-after-free issue was addressed with improved memory management.
CVE-2026-86986: an anonymous researcher
CVE-2026-112693: 은태 장
WebKit
Available for: macOS Sequoia and macOS Tahoe
Impact: Processing maliciously crafted web content may lead to an unexpected process crash
Description: This issue was addressed with improved input validation.
CVE-2026-86985: Pasquale Scola
WebKit
Available for: macOS Sequoia and macOS Tahoe
Impact: Processing maliciously crafted web content may result in the disclosure of process memory
Description: An out-of-bounds read was addressed with improved bounds checking.
CVE-2026-112699: an anonymous researcher
CVE-2026-112680: Franz Bettag, Kwak Kiyong, Song Nuri
WebKit
Available for: macOS Sequoia and macOS Tahoe
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: A use-after-free issue was addressed with improved memory management.
CVE-2026-112697: OpenAI Codex Security - Amy Burnett, 은태 장
CVE-2026-112655: Euntae Jang
CVE-2026-112651: Euntae Jang
CVE-2026-112623: pwn2addr, Lily Cohl (@GenericCoding)
WebKit
Available for: macOS Sequoia and macOS Tahoe
Impact: Processing maliciously crafted web content may lead to an unexpected process termination
Description: A race condition was addressed with improved locking.
CVE-2026-112686: an anonymous researcher
WebKit
Available for: macOS Sequoia and macOS Tahoe
Impact: Processing maliciously crafted web content may lead to an unexpected process crash
Description: This issue was addressed through improved state management.
CVE-2026-112684: Gia Bui (@yabeow) from Calif.io
WebKit
Available for: macOS Sequoia and macOS Tahoe
Impact: Processing maliciously crafted web content may lead to an unexpected process termination
Description: A type confusion issue was addressed with improved state handling.
CVE-2026-112673: Myungyong Lee
WebKit
Available for: macOS Sequoia and macOS Tahoe
Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash
Description: A race condition was addressed with improved state handling.
CVE-2026-112669: remanone (@remanone_)
WebKit
Available for: macOS Sequoia and macOS Tahoe
Impact: Processing maliciously crafted web content may lead to an unexpected process termination
Description: A use-after-free issue was addressed with improved memory management.
CVE-2026-112695: Josef Korbel (Citadelo), Luke Francis (@lukefr09)
CVE-2026-112666: Luke Francis (@lukefr09)
CVE-2026-112654: Charles Kern
CVE-2026-112653: Malik M. (@m411k_)
CVE-2026-112615: Chris Rohlf with Anthropic Research
WebKit
Available for: macOS Sequoia and macOS Tahoe
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: A type confusion issue was addressed with improved memory handling.
CVE-2026-112659: OpenAI Codex Security - Amy Burnett, Chris Rohlf with Anthropic Research
WebKit
Available for: macOS Sequoia and macOS Tahoe
Impact: Processing maliciously crafted web content may lead to memory corruption
Description: A use-after-free issue was addressed with improved memory management.
CVE-2026-112640: an anonymous researcher
WebKit
Available for: macOS Sequoia and macOS Tahoe
Impact: A website may be able to use a media format that should be restricted in Lockdown Mode
Description: A logic issue was addressed with improved checks.
CVE-2026-113952: Drinor Selmanaj (Sentry)
WebKit
Available for: macOS Sequoia and macOS Tahoe
Impact: Processing maliciously crafted web content may lead to memory corruption
Description: A type confusion issue was addressed with improved state management.
CVE-2026-113949: an anonymous researcher
WebKit
Available for: macOS Sequoia and macOS Tahoe
Impact: Processing maliciously crafted web content may lead to unexpected memory modification
Description: A use-after-free issue was addressed with improved memory management.
CVE-2026-113903: Eddy Tsalolikhin, OpenAI Codex Security - Amy Burnett, Lily Cohl (@GenericCoding)
WebKit Canvas
Available for: macOS Sequoia and macOS Tahoe
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: A use-after-free issue was addressed with improved memory management.
CVE-2026-112637: Chris Rohlf with Anthropic Research, 은태 장
WebKit JavaScript Bindings
Available for: macOS Sequoia and macOS Tahoe
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: A use-after-free issue was addressed with improved memory management.
CVE-2026-112626: Euntae Jang, Luke Francis (@lukefr09), Shubham Chaskar, Josef Korbel (Citadelo)
WebKit Process Model
Available for: macOS Sequoia and macOS Tahoe
Impact: A remote attacker may be able to break out of Web Content sandbox
Description: This issue was addressed by removing the vulnerable code.
CVE-2026-113897: Luke Francis, Jackson Kuja
WebKit Process Model
Available for: macOS Sequoia and macOS Tahoe
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: A use-after-free issue was addressed with improved memory management.
CVE-2026-112639: Luke Francis (@lukefr09)
WebRTC
Available for: macOS Sequoia and macOS Tahoe
Impact: Processing maliciously crafted web content may lead to an unexpected process crash
Description: A use-after-free issue was addressed with improved memory management.
CVE-2026-113901: Kwak Kiyong (@Pwnkai23), Song Nuri
WebRTC
Available for: macOS Sequoia and macOS Tahoe
Impact: Processing maliciously crafted web content may lead to an unexpected process crash
Description: An out-of-bounds read was addressed with improved bounds checking.
CVE-2026-86973: Narendra Singh (@_3P1C), an anonymous researcher
Products covered
macOS Sequoia and macOS Tahoe
Remediation
Separate remediation guidance was not included in the collected bulletin.
CVEs in this advisory 33
CVE-2026-112621CVE-2026-113904CVE-2026-112599CVE-2026-86974CVE-2026-86986CVE-2026-112693CVE-2026-86985CVE-2026-112699CVE-2026-112680CVE-2026-112697CVE-2026-112655CVE-2026-112651CVE-2026-112623CVE-2026-112686CVE-2026-112684CVE-2026-112673CVE-2026-112669CVE-2026-112695CVE-2026-112666CVE-2026-112654CVE-2026-112653CVE-2026-112615CVE-2026-112659CVE-2026-112640CVE-2026-113952CVE-2026-113949CVE-2026-113903CVE-2026-112637CVE-2026-112626CVE-2026-113897CVE-2026-112639CVE-2026-113901CVE-2026-86973
Updates
- Published by Apple Security Releases
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.