Apple Safari: 25 Vulnerabilities Disclosed Together, Ranging from Memory Corruption to Code Execution
Key findings • Apple disclosed 25 vulnerabilities affecting Safari and other operating systems on October 26, 2026. • The batch includes numerous use-after-free, type confusion, and out-of-bo…
Key findings
- Apple disclosed 25 vulnerabilities affecting Safari and other operating systems on October 26, 2026.
- The batch includes numerous use-after-free, type confusion, and out-of-bounds read vulnerabilities.
- Potential impacts range from unexpected crashes and memory corruption to arbitrary code execution.
- All vulnerabilities were patched in Safari 27.2 and corresponding OS updates.
- No vulnerabilities in this batch were reported as actively exploited in the wild.
On October 26, 2026, Apple Inc. disclosed a significant batch of 25 vulnerabilities affecting its Safari browser and other operating systems, including iOS, iPadOS, macOS, tvOS, watchOS, and visionOS. These vulnerabilities, all disclosed on the same day, range in severity and impact, with several allowing for arbitrary code execution or memory corruption through maliciously crafted web content. The disclosure highlights a consistent pattern of Apple addressing numerous security flaws in its software updates.
The disclosed vulnerabilities can be broadly categorized by their impact and the underlying memory management issues. Several use-after-free vulnerabilities, including CVE-2026-86986, CVE-2026-113904, CVE-2026-113903, CVE-2026-113901, CVE-2026-112697, CVE-2026-112695, CVE-2026-112666, CVE-2026-112654, and CVE-2026-112651, were addressed with improved memory management. These types of bugs can lead to unexpected crashes, memory corruption, or even arbitrary code execution if not properly handled.
Type confusion issues, such as those found in CVE-2026-86974, CVE-2026-113949, and CVE-2026-112659, were resolved through improved checks or state management, mitigating risks of memory corruption and arbitrary code execution. Additionally, out-of-bounds read vulnerabilities, including CVE-2026-86973, CVE-2026-112699, and CVE-2026-112680, were fixed with enhanced bounds checking, preventing potential disclosure of process memory.
Other vulnerabilities addressed in this batch include a logic issue in CVE-2026-113952, which could allow a website to use restricted media formats in Lockdown Mode, and a race condition in CVE-2026-112686 and CVE-2026-112669, resolved with improved locking and state handling, respectively. CVE-2026-113897, a vulnerability that could allow a remote attacker to break out of the Web Content sandbox, was addressed by removing the vulnerable code.
While the provided information does not indicate any of these specific vulnerabilities were actively exploited in the wild at the time of disclosure, the sheer volume and nature of these flaws underscore the importance of timely patching. The related news coverage from Vypr Intelligence and SANS ISC consistently noted that no vulnerabilities in this particular batch were reported as actively exploited, but emphasized the broad range of potential impacts, from system instability and data disclosure to arbitrary code execution.
All disclosed vulnerabilities were patched in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, and corresponding updates for tvOS, watchOS, and visionOS. Specific versions mentioned include iOS 26.7.2 and iPadOS 26.7.2, macOS Tahoe 26.7.2, and tvOS 27.2. Users are strongly advised to update their Apple devices to the latest available versions to protect against these security risks.
This coordinated disclosure of 25 vulnerabilities across multiple Apple platforms highlights the ongoing efforts by Apple's security teams to identify and remediate potential threats. Users of Safari and other affected Apple products should remain vigilant and apply updates promptly to maintain the security and integrity of their devices and data. The consistent release of such patches indicates a robust security development lifecycle at Apple, though the recurring nature of memory management issues warrants continued attention from both the vendor and the security community.