GCVE-1988-2026-0303 - Vulnerability-Lookup

GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

GCVE-1988-2026-0303

Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-11 11:51

Title

APPLE-SA-08-18-2026-1 Safari 26.6.1

Summary

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-08-18-2026-1 Safari 26.6.1 Safari 26.6.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/148286. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: An out-of-bounds access issue was addressed with improved bounds checking. WebKit Bugzilla: 317632 CVE-2026-64784: Janggoon Lee of Out of Bounds, OpenAI Codex Security - Amy Burnett WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 313452 CVE-2026-43795: wwwlk WebKit Bugzilla: 318348 CVE-2026-65338: OpenAI Codex Security - Amy Burnett WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to memory corruption Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 318405 CVE-2026-65341: Henock Habte WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A memory corruption vulnerability was addressed with improved locking. WebKit Bugzilla: 321480 CVE-2026-64782: Seonwook Kim, Shubham Chaskar, lattice, Josef Korbel WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: The issue was addressed with improved input validation. WebKit Bugzilla: 321484 CVE-2026-64781: Thomas Guillem WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: This issue was addressed through improved state management. WebKit Bugzilla: 321517 CVE-2026-65351: Niels Hofmans WebKit Bugzilla: 316996 CVE-2026-65340: Claudio Bozzato and Francesco Benvenuto of Cisco Talos, Josef Korbel (Citadelo) WebKit Bugzilla: 317142 CVE-2026-65337: OpenAI Codex Security - Amy Burnett WebKit Bugzilla: 317349 CVE-2026-65336: Josef Korbel WebKit Bugzilla: 316723 CVE-2026-65335: OpenAI Codex Security - Amy Burnett WebKit Bugzilla: 317603 CVE-2026-65333: OpenAI Codex Security - Amy Burnett WebKit Bugzilla: 317450 CVE-2026-65332: OpenAI Codex Security - Amy Burnett WebKit Bugzilla: 317611 CVE-2026-65331: OpenAI Codex Security - Amy Burnett WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 316347 CVE-2026-64715: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: The issue was addressed with improved checks. WebKit Bugzilla: 316918 CVE-2026-64780: OpenAI Codex Security - Amy Burnett WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A memory corruption issue was addressed with improved state management. WebKit Bugzilla: 316791 CVE-2026-65334: OpenAI Codex Security - Amy Burnett WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to memory corruption Description: A memory corruption issue was addressed with improved memory handling. WebKit Bugzilla: 317317 CVE-2026-43794: Dung Do (@_piers2) of Calif.io WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected process termination Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 313703 CVE-2026-64787: 杉山壮太, Shubham Chaskar WebKit History Available for: macOS Sonoma and macOS Sequoia Impact: Visiting a maliciously crafted website may leak sensitive data Description: The issue was addressed with improved checks. WebKit Bugzilla: 315528 CVE-2026-64778: Mohit Negi WebKit Storage Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A memory corruption vulnerability was addressed with improved locking. WebKit Bugzilla: 321485 CVE-2026-64779: Shubham Chaskar, Tommy DeVoss from Braze Security Team (@thedawgyg) Additional recognition WebKit We would like to acknowledge Henock Habte for their assistance. Safari 26.6.1 may be obtained from the Mac App Store. All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmqEtoMACgkQ4Ifiq8DH 7PXAJw//TT8E/xNXFpPvYP4AalRggghX1B0wdLSFdd2py/EsbRloEErOZf5dZ52E wl3IwcqcNoCbGrcWYx1zFhSn92sgqV6eOQ6ff4BpLp82BRTeISDllKHpX+aZ1LsR 9AL69KgQ4nQjoalq0e8vc4+cE3H59YKg4xC5vXMMt/tNZKfdzwB8x8yZNEFkl1So j7wAkOtBudbQOo4yaXs7hqBsutkMgxuPr79nIJYv0ye8fbk9IfhA3dKRnSIBYpGe 1coG9gQ/5DMn1IF0AQ0H3Tg9ZxBZcQVpSMs2EuLYzV84eUZ4Pp8lBansDnMZdaSc SKP08qQ0CRD0Q3xh2L8hzYKYocNpXtOW12BSuIaY3BC/QgPHwTZQEECbpTuleQLe NFZxY9JEWPtzr5CEq3crlaXihtNbeQA4VhgSrWhYFdUaLKDFBBHIat5wEVlMPgt1 n+ml4wUzdRdfOI9GMeCPbZqIvySdf+EALS+opMzCeXb6HJ84qo8dLi9BMUESucfp EmSW2dwAAHreuYwykHEuZoFjd3uR0eicEmTHPV/Ujm6NJOgD7qv0cO7jTfc91KuC udOqx2AcyJLKRupddWeUBYVXZLzQO9XUnUa8K5w2tIqhd3PT+HwsnFb7k4GpaUIK vj31dfQghVhRuqRDApLd+CVsjsKR6NkZenBKhhf3knDDoMX/dPI= =LOpe -----END PGP SIGNATURE----- _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/

Severity

No CVSS data available.

Assigner

VULNARCHIVE GNA-1988

References

7 references

URL	Tags
https://vuln.freearchive.org/archive/full-disclos…	technical-description
https://seclists.org/fulldisclosure/2026/Aug/69	technical-description
https://nmap.org/mailman/listinfo/fulldisclosure
https://seclists.org/fulldisclosure/
https://support.apple.com/100100
https://support.apple.com/148286
https://www.apple.com/support/security/pgp/

Impacted products

1 product

Vendor	Product	Version	CPE status
Apple	Safari	Affected: unknown	guessed

Credits

Apple Product Security via Fulldisclosure

Relationships

reference GCVE-1988-2026-0303 (this record)

related CVE-2026-43794
related CVE-2026-43795
related CVE-2026-64715
related CVE-2026-64778
related CVE-2026-64779
related CVE-2026-64780
related CVE-2026-64781
related CVE-2026-64782
related CVE-2026-64784
related CVE-2026-64787
related CVE-2026-65331
related CVE-2026-65332
related CVE-2026-65333
related CVE-2026-65334
related CVE-2026-65335
related CVE-2026-65336
related CVE-2026-65337
related CVE-2026-65338
related CVE-2026-65340
related CVE-2026-65341
related CVE-2026-65351

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-08-18-2026-1 Safari 26.6.1\n\nSafari 26.6.1 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/148286.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nWebKit Bugzilla: 317632\nCVE-2026-64784: Janggoon Lee of Out of Bounds, OpenAI Codex Security -\nAmy Burnett\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 313452\nCVE-2026-43795: wwwlk\nWebKit Bugzilla: 318348\nCVE-2026-65338: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 318405\nCVE-2026-65341: Henock Habte\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nWebKit Bugzilla: 321480\nCVE-2026-64782: Seonwook Kim, Shubham Chaskar, lattice, Josef Korbel\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 321484\nCVE-2026-64781: Thomas Guillem\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: This issue was addressed through improved state management.\nWebKit Bugzilla: 321517\nCVE-2026-65351: Niels Hofmans\nWebKit Bugzilla: 316996\nCVE-2026-65340: Claudio Bozzato and Francesco Benvenuto of Cisco Talos,\nJosef Korbel (Citadelo)\nWebKit Bugzilla: 317142\nCVE-2026-65337: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317349\nCVE-2026-65336: Josef Korbel\nWebKit Bugzilla: 316723\nCVE-2026-65335: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317603\nCVE-2026-65333: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317450\nCVE-2026-65332: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317611\nCVE-2026-65331: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 316347\nCVE-2026-64715: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved checks.\nWebKit Bugzilla: 316918\nCVE-2026-64780: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption issue was addressed with improved state\nmanagement.\nWebKit Bugzilla: 316791\nCVE-2026-65334: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nWebKit Bugzilla: 317317\nCVE-2026-43794: Dung Do (@_piers2) of Calif.io\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process termination\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313703\nCVE-2026-64787: \u6749\u5c71 \u58ee\u592a, Shubham Chaskar\n\nWebKit History\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Visiting a maliciously crafted website may leak sensitive data\nDescription: The issue was addressed with improved checks.\nWebKit Bugzilla: 315528\nCVE-2026-64778: Mohit Negi\n\nWebKit Storage\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nWebKit Bugzilla: 321485\nCVE-2026-64779: Shubham Chaskar, Tommy DeVoss from Braze Security Team\n(@thedawgyg)\n\nAdditional recognition\n\nWebKit\nWe would like to acknowledge Henock Habte for their assistance.\n\nSafari 26.6.1 may be obtained from the Mac App Store.\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmqEtoMACgkQ4Ifiq8DH\n7PXAJw//TT8E/xNXFpPvYP4AalRggghX1B0wdLSFdd2py/EsbRloEErOZf5dZ52E\nwl3IwcqcNoCbGrcWYx1zFhSn92sgqV6eOQ6ff4BpLp82BRTeISDllKHpX+aZ1LsR\n9AL69KgQ4nQjoalq0e8vc4+cE3H59YKg4xC5vXMMt/tNZKfdzwB8x8yZNEFkl1So\nj7wAkOtBudbQOo4yaXs7hqBsutkMgxuPr79nIJYv0ye8fbk9IfhA3dKRnSIBYpGe\n1coG9gQ/5DMn1IF0AQ0H3Tg9ZxBZcQVpSMs2EuLYzV84eUZ4Pp8lBansDnMZdaSc\nSKP08qQ0CRD0Q3xh2L8hzYKYocNpXtOW12BSuIaY3BC/QgPHwTZQEECbpTuleQLe\nNFZxY9JEWPtzr5CEq3crlaXihtNbeQA4VhgSrWhYFdUaLKDFBBHIat5wEVlMPgt1\nn+ml4wUzdRdfOI9GMeCPbZqIvySdf+EALS+opMzCeXb6HJ84qo8dLi9BMUESucfp\nEmSW2dwAAHreuYwykHEuZoFjd3uR0eicEmTHPV/Ujm6NJOgD7qv0cO7jTfc91KuC\nudOqx2AcyJLKRupddWeUBYVXZLzQO9XUnUa8K5w2tIqhd3PT+HwsnFb7k4GpaUIK\nvj31dfQghVhRuqRDApLd+CVsjsKR6NkZenBKhhf3knDDoMX/dPI=\n=LOpe\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/69"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/69"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/148286"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/69"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-08-18-2026-1 Safari 26.6.1",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-43794",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43795",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64715",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64778",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64779",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64780",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64781",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64782",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64784",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64787",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65331",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65332",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65333",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65334",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65335",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65336",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65337",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65338",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65340",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65341",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65351",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0303",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/69",
            "automated": true,
            "contentSha256": "e7bc2955faffd4542bd9f546314cba669e5bbd24ea91d092114a1f773497ef5e",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/69",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T19:51:27Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0303"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:40:49Z",
    "dateUpdated": "2026-09-11T11:51:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0303"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-65351 (GCVE-0-2026-65351)

Vulnerability from cvelistv5 – Published: 2026-08-17 21:31 – Updated: 2026-08-18 17:59

Summary

This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-18 13:00 UTC

CWE

Processing maliciously crafted web content may lead to an unexpected Safari crash
CWE-703 - Improper Check or Handling of Exceptional Conditions

Assigner

apple mitre root

References

3 references

URL	Tags
https://support.apple.com/en-us/148281
https://support.apple.com/en-us/148282
https://support.apple.com/en-us/148286

Impacted products

3 products

Vendor	Product	Version
Apple	Safari	Affected: 0 , < 26.6.1 (custom)
Apple	iOS and iPadOS	Affected: 0 , < 26.6.1 (custom)
Apple	macOS	Affected: 0 , < 26.6.2 (custom)

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-65351",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-18T13:00:05.468201Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-703",
                "description": "CWE-703 Improper Check or Handling of Exceptional Conditions",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-18T13:00:10.886Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.6.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.6.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.6.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing maliciously crafted web content may lead to an unexpected Safari crash",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T17:59:41.773Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/148281"
        },
        {
          "url": "https://support.apple.com/en-us/148282"
        },
        {
          "url": "https://support.apple.com/en-us/148286"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2026-65351",
    "datePublished": "2026-08-17T21:31:25.582Z",
    "dateReserved": "2026-07-22T00:45:50.324Z",
    "dateUpdated": "2026-08-18T17:59:41.773Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.