VYPR
← All advisories
Medium severity5.4NVD Advisory· Published Sep 14, 2026· Updated Sep 18, 2026

CVE-2026-86898

CVE-2026-86898

Description

A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening a maliciously crafted webarchive file may lead to universal cross-site scripting.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

10
  • Apple Inc./Safari2 versions
    cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*range: <27.0
    • (no CPE)range: = 27
  • Apple Inc./Ipados2 versions
    cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*range: <27.0
    • (no CPE)range: = 27
  • Apple Inc./Iphone OS
    cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
    Range: <27.0
  • Apple Inc./macOS
    cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
    Range: <27.0
  • Apple Inc./Visionos2 versions
    cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*range: <27.0
    • (no CPE)range: = 27
  • Apple Inc./macOS Golden Gatellm-fuzzy
    Range: = 27
  • Apple Inc./iOSllm-fuzzy
    Range: = 27

Patches

Vulnerability mechanics

References

4

News mentions

6