Apple patches Safari 27 and Xcode 27 privacy flaws
First coverage.
Apple's Sept. 14 advisories fix a Safari app-detection flaw and a Xcode permissions issue; no CVEs or exploitation were reported.
Apple Product Security issued two advisories dated September 14, 2026, later reposted to Full Disclosure on September 22. APPLE-SA-09-14-2026-9 is for Safari 27 on macOS Sequoia and macOS Tahoe and says a malicious website may be able to determine which apps a user has installed, citing Apple support document 149039. APPLE-SA-09-14-2026-10 is for Xcode 27 on macOS Tahoe 26.6 and later and describes a permissions issue that may allow an app to access user-sensitive data, citing support document 149040. Neither notice lists CVE identifiers or reports exploitation. The reports do not disagree; they describe separate products and flaws.
- APPLE-SA-09-14-2026-9 covers Safari 27 on macOS Sequoia and macOS Tahoe.
- Safari impact: a malicious website may be able to determine which apps a user has installed (Apple support document 149039).
- APPLE-SA-09-14-2026-10 covers Xcode 27, available on macOS Tahoe 26.6 and later.
- Xcode impact: a permissions issue may allow an app to access user-sensitive data (Apple support document 149040).
- Neither advisory lists CVE identifiers or reports in-the-wild exploitation.
- Both notices were reposted to Full Disclosure on 2026-09-22.
Coverage
oldest first · one row per article · UTC- · Sep 22, 2026
Full DisclosureFirst report
APPLE-SA-09-14-2026-9 Safari 27
Apple's Safari 27 update fixes a flaw letting a malicious site detect installed apps.
- · Sep 22, 2026
APPLE-SA-09-14-2026-10 Xcode 27
Apple patched a Xcode 27 permissions flaw that could let an app access user-sensitive data.