CVE-2026-64778 Details
Description
The issue was addressed with improved checks. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. Visiting a maliciously crafted website may leak sensitive data.
A vulnerability in WebKit, the engine used by Safari and other Apple applications, may lead to unauthorized data leakage. This issue is present in multiple Apple operating systems, including iOS 18.7.10, iPadOS 18.7.10, macOS Tahoe, tvOS 27, visionOS 27, and watchOS 27. The vulnerability arises from insufficient validation when processing web content, which can be exploited by visiting a maliciously crafted website.
Users can update to Safari 26.6.1, iOS 18.7.10, iPadOS 18.7.10, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, or watchOS 27 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://support.apple.com/en-us/148281 | [email protected] | Release NotesVendor Advisory |
| https://support.apple.com/en-us/148282 | [email protected] | Release NotesVendor Advisory |
| https://support.apple.com/en-us/148286 | [email protected] | Release NotesVendor Advisory |
| https://support.apple.com/en-us/148287 | [email protected] | Release NotesVendor Advisory |
| https://support.apple.com/en-us/149036 | [email protected] | |
| https://support.apple.com/en-us/149037 | [email protected] | |
| https://support.apple.com/en-us/149038 | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| apple safari | < 26.6.1 |
CPE
Remediation
| |
| apple ipados | < 18.7.10 >= 26.0, < 26.6.1 |
CPE
Remediation
| |
| apple iphone os | < 18.7.10 >= 26.0, < 26.6.1 |
CPE
Remediation
| |
| apple macos | >= 26.0, < 26.6.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | [email protected] |
| Aug 18, 2026 | Initial Analysis | [email protected] |
| Aug 18, 2026 | CVE Modified | [email protected] |
| Aug 18, 2026 | CVE Modified | CISA-ADP |
| Aug 17, 2026 | New CVE Received | [email protected] |