Safari type confusion bug allows remote code execution
CVE-2026-86974 is scored CVSS 8.8 and requires a user to open a malicious page or file.
58
Vulnerability1 · 1 read
CVE-2026-86974
Type confusion in Safari via crafted web content
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A type confusion flaw in Apple Safari (jsToWasm IC entrypoint, per ZDI) was fixed with improved checks. Processing maliciously crafted web content can corrupt memory and, as classified by ZDI, lead to remote code execution. A victim must load the content in Safari or WebKit on affected Apple systems.
What to do: Update to Safari 27.2, iOS and iPadOS 26.7.2 or 27.2, macOS Golden Gate 27.2, or visionOS 27.2.
| Product | Affected | Fixed in |
|---|---|---|
| Apple Safari | — | 27.2 |
| Apple iOS | — | 26.7.2 and 27.2 |
| Apple iPadOS | — | 26.7.2 and 27.2 |
| Apple macOS Golden Gate | — | 27.2 |
| Apple visionOS | — | 27.2 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A type confusion issue was addressed with improved checks. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to memory corruption.