GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

GCVE-1988-2026-0294

Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-09 10:11
VLAI
Title
APPLE-SA-07-27-2026-8 Safari 26.6
Summary
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-07-27-2026-8 Safari 26.6 Safari 26.6 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/128073. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Safari Available for: macOS Sonoma and macOS Sequoia Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-43792: Ilya Andr (andrd3v) WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may result in the disclosure of process memory Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 308046 CVE-2026-43740: Arni Hardarson, Nathaniel Oh (@calysteon) WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Websites may know if the user has visited a given link Description: This issue was addressed with improved checks. WebKit Bugzilla: 316827 CVE-2026-64713: Kwak Kiyong, Song Nuri WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Visiting a website that frames malicious content may lead to UI spoofing Description: The issue was addressed with improved UI. WebKit Bugzilla: 311660 CVE-2026-64730: Kagami Rosylight of Mozilla WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Maliciously crafted web content may violate iframe sandboxing policy Description: A permissions issue was addressed with improved validation. WebKit Bugzilla: 313220 CVE-2026-64728: an anonymous researcher WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 313521 CVE-2026-64783: 杉山 壮太, lattice, Behzad Najjarpour Jabbari (@_G4ru_), Junyeong Lee, Mooth.ai, OGINOME Tomohito, Using GLM From Z.AI, Gia Bui (@yabeow) from Calif.io WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A memory corruption issue was addressed with improved state management. WebKit Bugzilla: 315082 CVE-2026-64757: Milad Nasr and Nicholas Carlini with Claude, Anthropic WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Visiting a website may lead to an app denial-of-service Description: This issue was addressed through improved state management. WebKit Bugzilla: 316816 CVE-2026-43804: Heiko Kiesel of SEEMOO, TU Darmstadt WebKit Available for: macOS Sonoma and macOS Sequoia Impact: An app may be able to read files outside of its sandbox Description: An access issue was addressed with improved access restrictions. WebKit Bugzilla: 314867 CVE-2026-43821: Brian Carpenter WebKit Canvas Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 313935 CVE-2026-64718: OGINOME Tomohito, an anonymous researcher WebRTC Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: An out-of-bounds access issue was addressed with improved bounds checking. WebKit Bugzilla: 319404 CVE-2026-64719: Shaheen Fazim Additional recognition Safari Downloads We would like to acknowledge Alfaz Hossain for their assistance. WebKit We would like to acknowledge Jaya Surya Kommireddy, Jaya surya Kommireddy, Lukas Knittel (@kunte_ctf) of Ruhr-University Bochum, Nikos Fanourakis of Technical University of Crete, Sotiris Ioannidis of Technical University of Crete, Panagiotis Ilia of Cyprus University of Technology, and Kostas Drakonakis of Technical University of Crete, Tony Gorez (@tonygo_) for Reverse Society, Vitaly Simonovich, Youngjoon Kim of Team-Atlanta & sslab at Georgia Tech, s3zer0 for their assistance. WebKit Canvas We would like to acknowledge Codex Security - Khai Tran, Daisuke Hatakeyama and Ryohei Ueki (@SYZD Research), David Bors at Snyk Security Labs, Giovanni Vignone and Robert van Eijk of Octane Security (octane.security), Kwak Kiyong, Song nuri, Luat Nguyen (CyberJutsu Academy), Tom Van Goethem, an anonymous researcher, dr3dd for their assistance. WebKit Storage We would like to acknowledge Gurpreet Shergill, Luke Francis, Milad Nasr and Nicholas Carlini with Claude, Anthropic, Oleh Konko of 1seal (1seal.org), Vitaly Simonovich for their assistance. Safari 26.6 may be obtained from the Mac App Store. All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmpn4iMACgkQ4Ifiq8DH 7PUTig//dN43HRyvQWDfL6xMYj1NvUVLsWy8KXyMy33uJ4A3K+7H0lsFPpVusN5R TAPd6SOjmrMAH04dveKIy6isyZUxG6P6Ez7nLZXkalw8UCRt0QDzFZJQT2dgPzrY n57bQLrkw5HXAStWcviCbQCU9OjZVg44kWOHkI18AngBnpgF6Xcdn2KsO8A1UVj6 MLtFMg9AArwT+FMC1mqJv5IYGQZaDmcCNjz9+dm4ryHeOBpHm5t3stPr8fiOLgM8 nYuzKQc0ABsS+ne8/Ivter+iLDYM2ZH/EhswBDeIWuS7RTwAAsOwwMi6HGJAkpJU WNrPz+yMY+oO1M/+6KRDP+3L6H1P4hSxgCRcreokE1JnjuvGgDEiq2s1r7GGJL2L +RCnKAnL0c+B0EEedYH6Yi3jcLzaqKXnlfJBdVu7IKW7VjRcr07IwmemeIMfFF+O ctCTvHUGT723b63D131qqCcnUgiprijhJ02Sw/IaHQckxUeNt/USY0eYuQbhfC+y X1olXowGzDRXznuCze2L33jCjYy9MFJp/8K2s2ap4yTAR9jlohdP1GrxQcDj1NUu XaDKOq3VUF2Z+S1OpEOVn8pgax4evoHyu8Nh7AsuwiTw07VKq3qfg/0SZbuOcnLq aKYx+4St5AyBVKlzR489dL3V9fRkov1dwA3iPVLR35vCan8E83w= =3nQh -----END PGP SIGNATURE----- _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Apple APPLE-SA-07-27-2026-8 Safari Affected: unknown
guessed Create a notification for this product.
Credits
Apple Product Security via Fulldisclosure
Relationships
reference GCVE-1988-2026-0294 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "APPLE-SA-07-27-2026-8 Safari",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-07-27-2026-8 Safari 26.6\n\nSafari 26.6 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/128073.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nSafari\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-43792: Ilya Andr (andrd3v)\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may result in the\ndisclosure of process memory\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 308046\nCVE-2026-43740: Arni Hardarson, Nathaniel Oh (@calysteon)\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Websites may know if the user has visited a given link\nDescription: This issue was addressed with improved checks.\nWebKit Bugzilla: 316827\nCVE-2026-64713: Kwak Kiyong, Song Nuri\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Visiting a website that frames malicious content may lead to UI\nspoofing\nDescription: The issue was addressed with improved UI.\nWebKit Bugzilla: 311660\nCVE-2026-64730: Kagami Rosylight of Mozilla\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Maliciously crafted web content may violate iframe sandboxing\npolicy\nDescription: A permissions issue was addressed with improved validation.\nWebKit Bugzilla: 313220\nCVE-2026-64728: an anonymous researcher\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313521\nCVE-2026-64783: \u6749\u5c71 \u58ee\u592a, lattice, Behzad Najjarpour Jabbari (@_G4ru_),\nJunyeong Lee, Mooth.ai, OGINOME Tomohito, Using GLM From Z.AI, Gia Bui\n(@yabeow) from Calif.io\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption issue was addressed with improved state\nmanagement.\nWebKit Bugzilla: 315082\nCVE-2026-64757: Milad Nasr and Nicholas Carlini with Claude, Anthropic\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Visiting a website may lead to an app denial-of-service\nDescription: This issue was addressed through improved state management.\nWebKit Bugzilla: 316816\nCVE-2026-43804: Heiko Kiesel of SEEMOO, TU Darmstadt\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: An app may be able to read files outside of its sandbox\nDescription: An access issue was addressed with improved access\nrestrictions.\nWebKit Bugzilla: 314867\nCVE-2026-43821: Brian Carpenter\n\nWebKit Canvas\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313935\nCVE-2026-64718: OGINOME Tomohito, an anonymous researcher\n\nWebRTC\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nWebKit Bugzilla: 319404\nCVE-2026-64719: Shaheen Fazim\n\nAdditional recognition\n\nSafari Downloads\nWe would like to acknowledge Alfaz Hossain for their assistance.\n\nWebKit\nWe would like to acknowledge Jaya Surya Kommireddy, Jaya surya\nKommireddy, Lukas Knittel (@kunte_ctf) of Ruhr-University Bochum, Nikos\nFanourakis of Technical University of Crete, Sotiris Ioannidis of\nTechnical University of Crete, Panagiotis Ilia of Cyprus University of\nTechnology, and Kostas Drakonakis of Technical University of Crete, Tony\nGorez (@tonygo_) for Reverse Society, Vitaly Simonovich, Youngjoon Kim\nof Team-Atlanta \u0026 sslab at Georgia Tech, s3zer0 for their assistance.\n\nWebKit Canvas\nWe would like to acknowledge Codex Security - Khai Tran, Daisuke\nHatakeyama and Ryohei Ueki (@SYZD Research), David Bors at Snyk Security\nLabs, Giovanni Vignone and Robert van Eijk of Octane Security\n(octane.security), Kwak Kiyong, Song nuri, Luat Nguyen (CyberJutsu\nAcademy), Tom Van Goethem, an anonymous researcher, dr3dd for their\nassistance.\n\nWebKit Storage\nWe would like to acknowledge Gurpreet Shergill, Luke Francis, Milad Nasr\nand Nicholas Carlini with Claude, Anthropic, Oleh Konko of 1seal\n(1seal.org), Vitaly Simonovich for their assistance.\n\nSafari 26.6 may be obtained from the Mac App Store.\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmpn4iMACgkQ4Ifiq8DH\n7PUTig//dN43HRyvQWDfL6xMYj1NvUVLsWy8KXyMy33uJ4A3K+7H0lsFPpVusN5R\nTAPd6SOjmrMAH04dveKIy6isyZUxG6P6Ez7nLZXkalw8UCRt0QDzFZJQT2dgPzrY\nn57bQLrkw5HXAStWcviCbQCU9OjZVg44kWOHkI18AngBnpgF6Xcdn2KsO8A1UVj6\nMLtFMg9AArwT+FMC1mqJv5IYGQZaDmcCNjz9+dm4ryHeOBpHm5t3stPr8fiOLgM8\nnYuzKQc0ABsS+ne8/Ivter+iLDYM2ZH/EhswBDeIWuS7RTwAAsOwwMi6HGJAkpJU\nWNrPz+yMY+oO1M/+6KRDP+3L6H1P4hSxgCRcreokE1JnjuvGgDEiq2s1r7GGJL2L\n+RCnKAnL0c+B0EEedYH6Yi3jcLzaqKXnlfJBdVu7IKW7VjRcr07IwmemeIMfFF+O\nctCTvHUGT723b63D131qqCcnUgiprijhJ02Sw/IaHQckxUeNt/USY0eYuQbhfC+y\nX1olXowGzDRXznuCze2L33jCjYy9MFJp/8K2s2ap4yTAR9jlohdP1GrxQcDj1NUu\nXaDKOq3VUF2Z+S1OpEOVn8pgax4evoHyu8Nh7AsuwiTw07VKq3qfg/0SZbuOcnLq\naKYx+4St5AyBVKlzR489dL3V9fRkov1dwA3iPVLR35vCan8E83w=\n=3nQh\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:11:18Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/23"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/23"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/en-us/128073"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/23"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-07-27-2026-8 Safari 26.6",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-43740",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43792",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43804",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43821",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64713",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64718",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64719",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64728",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64730",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64757",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64783",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0294",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/23",
            "automated": true,
            "contentSha256": "38f987ac49c6174abe8e7fb441f3c17c5e00305bda36174c90f11839c358c339",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/23",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-28T00:27:54Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0294"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:40:48Z",
    "dateUpdated": "2026-09-09T10:11:18Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0294"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.