Safari type confusion bug allows remote code execution
Original title: ZDI-26-830: Apple Safari jsToWasm IC Entrypoint Type Confusion Remote Code Execution Vulnerability
CVE-2026-86974 is scored CVSS 8.8 and requires a user to open a malicious page or file.
ZDI published ZDI-26-830, a type confusion in Apple Safari's jsToWasm IC entrypoint. A remote attacker can execute arbitrary code if the user visits a malicious page or opens a malicious file. ZDI assigned CVSS 8.8 and CVE-2026-86974; versions and a fix are not stated.
Unconfirmed: Affected Safari versions, a fix, and exploitation status are not stated.
- User interaction is required to exploit the flaw.
- The bug is a type confusion in the jsToWasm IC entrypoint.
- ZDI assigned CVE-2026-86974 and a CVSS rating of 8.8.
Impact: remote arbitrary code execution after user interaction
| Product | Affected |
|---|---|
| Apple Safari | — |
- CVEs
- CVE-2026-86974
- Vendors
- Apple
- Products
- Safari
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-86974 | Type confusion in Safari via crafted web content | — | — |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple Safari. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 8.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.