CVE-2026-86898

CVE-2026-86898 is a logic flaw caused by improper state management in Apple's handling of webarchive files, which are saved web page bundles produced by Safari. An attacker triggers the bug by convincing a victim to open a maliciously crafted .webarchive file, after which the attacker achieves universal cross-site scripting (UXSS) — the ability to run attacker-controlled script in the security context of arbitrary websites, effectively bypassing the same-origin policy. Successful exploitation can lead to session/token theft, impersonation of the victim on any site they use, and manipulation of content in other origins. The flaw affects Safari, iOS, iPadOS, macOS Golden Gate, and visionOS, and is fixed in Safari 27, iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27. No public proof of concept is known and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog, though the fix shipped as part of a large coordinated Apple security update.

What to do: Patch to Safari 27, iOS 27, iPadOS 27, macOS Golden Gate 27, or visionOS 27 as soon as rollout permits, prioritizing devices that regularly receive files from outside the organization. Instruct users not to open unsolicited or untrusted .webarchive files, and consider blocking or sandboxing .webarchive attachments at mail and download gateways until patching completes. Use MDM compliance reporting to verify all managed Apple devices have applied the 27-series updates.