visionOS 27
149038
Summary
No separate summary was provided in the collected bulletin.
View 8 component changes
Safari
Available for: macOS Sequoia and macOS Tahoe
Impact: A malicious website may be able to determine what apps a user has installed
Description: This issue was addressed through improved state management.
CVE-2026-84518: Bálint Magyar (balintmagyar.com)
Safe Browsing
Available for: macOS Sequoia and macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with additional entitlement checks.
CVE-2026-86897: Stuart Wallace
WebKit
Available for: macOS Sequoia and macOS Tahoe
Impact: Processing maliciously crafted web content may lead to an unexpected process termination
Description: A logic issue was addressed with improved state management.
CVE-2026-84635: Souta Sugiyama
WebKit
Available for: macOS Sequoia and macOS Tahoe
Impact: Processing maliciously crafted web content may disclose sensitive user information
Description: A permissions issue was addressed by removing the vulnerable code.
CVE-2026-64753: Viggo Lekdorf
WebKit
Available for: macOS Sequoia and macOS Tahoe
Impact: Opening a maliciously crafted webarchive file may lead to universal cross-site scripting
Description: A logic issue was addressed with improved state management.
CVE-2026-86898: Tomi Garcia (archyxsec)
WebKit
Available for: macOS Sequoia and macOS Tahoe
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: A type confusion issue was addressed with improved state management.
CVE-2026-86922: Nathaniel Oh (@calysteon), Kwak Kiyong / kakaogames
WebKit
Available for: macOS Sequoia and macOS Tahoe
Impact: Processing maliciously crafted web content may lead to unexpected behavior
Description: A logic issue was addressed with improved state management.
CVE-2026-86872: Junhyuk Im of S2W Inc, Seungyun Lee of S2W Inc
WebKit Canvas
Available for: macOS Sequoia and macOS Tahoe
Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash
Description: A use-after-free issue was addressed with improved memory management.
CVE-2026-64718: Niels Hofmans, OGINOME Tomohito, an anonymous researcher
Products covered
macOS Sequoia and macOS Tahoe
Remediation
Separate remediation guidance was not included in the collected bulletin.
CVEs in this advisory 8
Update history
What changed in later vendor updates
SecurityAlert records field-level changes from the point we begin following a bulletin. Earlier vendor changes may not have a field-by-field record.
- Added CVEs: CVE-2026-86872, CVE-2026-86922.
Updates
- Published by Apple Security Releases
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.