CISA adds exploited Apple PAC bypass CVE-2024-27834 to KEV
Federal agencies must fix the flaw by November 18, 2026; Sekoia ties its use to APT29 with moderate to high confidence.
Stories per day · 30 days
2 RSS
Relatedapple7chrome5ios5macos4claude3android2anthropic2coordinated-disclosure2privacy2webkit2apt291breach-check1browser1cisa1clickfix1consumer-security1email1exploit-kit1
22 stories, newest first · one card per story
Stories tagged #safari
Apple products contain pointer authentication bypass vulnerability
iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain improper authentication vulnerability allowing arbitrary read and write capability.
Coruna and DarkSword kits steal iPhone data from one web visit
Zimperium found 608 domains serving version-specific chains, including a backdoored npm package that infects visitors of otherwise ordinary sites.
Apple advisory AV26-1099 lists flaws in iOS, macOS, Safari and more
Affected builds are those before the stated iOS, iPadOS, macOS, visionOS, tvOS, watchOS and Safari releases.
Unreleased Claude model wrote Chrome, Linux and Android exploit chains
Anthropic says the lab-only chains were reported first and fixed, including Chrome 156, with no real-world incidents.
Anthropic's unreleased model chained flaws into patched OS exploits
Lab proofs, not live attacks, covered Chrome 156, iOS 26.5.2, Windows CVE-2026-33096, and Linux CVE-2026-98432.
Safari type confusion bug allows remote code execution
CVE-2026-86974 is scored CVSS 8.8 and requires a user to open a malicious page or file.
Anthropic says Claude built critical exploit chains in Chrome, Safari and Android
Google assigned 62 critical or high Chrome CVEs, patched as of Chrome 156; Apple and Google say the Safari and Android issues are fixed.
Apple patches 286 iOS and macOS bugs, backports exploited flaw
iOS and iPadOS 18.7.11 carry the CVE-2026-86950 fix; Apple says iOS and macOS 27 are not affected.
Safari 27.2 fixes LinkPresentation crafted-image memory issue
The issue is listed for Safari on macOS Sequoia and macOS Tahoe, and the memory impact is truncated.
Chrome warns Enhanced Protection users before they run ClickFix commands
Copied commands are scrubbed and checked by Safe Browsing, and Chrome is also expanding scam and financial-ad checks.
Safari and WebKit block services that turn emails into tracking IDs
The blocks ship in iOS 27, iPadOS 27, macOS 27, and visionOS 27 and stop pages from sending addresses to identity-resolution servers.
Product showcase: GuardOS checks QR links, scans for data breaches, and filters Safari content
GuardOS for iPhone bundles Safari filtering, breach lookups, QR-link checks, and photo storage cleanup.
3
Product showcase: Webroot Mobile Security screens texts, blocks risky sites, and checks for data leaks
Webroot Mobile Security screens SMS scams, blocks risky sites, and monitors breach exposure on iOS and Android.
2
Safari History Database Tags Can Reveal Users’ Browsing Themes in Forensic Investigations
Safari History.db stores Wikidata-linked topic tags that can reveal browsing themes in macOS investigations.
Safari History Database Tags Can Reveal What Users Were Browsing on macOS
Safari History.db topic tags can reveal macOS browsing themes even after some history records are removed.
Fake iPhone Duo preorder scam triggers DarkSword attack
A fake iPhone Duo preorder page uses the patched DarkSword chain to steal iPhone data on visit.
APPLE-SA-09-14-2026-9 Safari 27
Apple's Safari 27 update fixes a flaw letting a malicious site detect installed apps.
Apple security advisory (AV26-930)
CCCS relays Apple's September 14, 2026 security updates fixing vulnerabilities across iOS 27, macOS Tahoe 26.7, Sequoia 15.8, Safari, and other products.
Apple Rolls Out Massive Security Update Fixing 273 Vulnerabilities Across Its Devices
Apple's coordinated rollout patches 273 unique vulnerabilities across iOS 27, macOS Golden Gate 27, watchOS and Safari, including remote code execution flaws.
Apple iCloud Private Relay Can Expose Real IPs Through WebKit Proxy Bypasses
Researchers found WebKit features bypass proxies and iCloud Private Relay, leaking users' real IP addresses; Apple patched in iOS 26.6.1 and macOS 26.6.2.
2
ZDI-26-610: Apple Safari JavaScriptCore B3 ReduceStrength Phase Use-After-Free Remote Code Execution Vulnerability
ZDI details a use-after-free in Apple Safari's JavaScriptCore (CVE-2026-64715) that allows remote code execution after a user visits a malicious page.