CVE-2026-86872: Apple Safari vulnerability
Published Oct 20, 2026
·Updated
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to unexpected behavior.
Affected Software
3 affected components
Apple Safari=27
Apple visionOS=27
Apple WatchOS=27
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Safarito a version that resolves this vulnerability.Fixed in 27 - Upgrade
Upgrade
visionOSto a version that resolves this vulnerability.Fixed in 27 - Upgrade
Upgrade
watchOSto a version that resolves this vulnerability.Fixed in 27
Event History
Oct 20, 2026
CVE Published
via MITRE·12:50 AM
Data Sourced
via MITRE·12:50 AM
DescriptionWeakness
Data Sourced
via NVD·01:17 AM
Description
Frequently Asked Questions
1
Which Apple platforms have fixes available for this issue?
Apple lists fixes in Safari 27, visionOS 27, and watchOS 27.
2
What must an attacker do to trigger the issue?
The issue may be triggered when a user processes maliciously crafted web content.
3
What is the documented impact?
Processing malicious web content may lead to unexpected behavior. The provided information does not describe a more specific impact or exploitation outcome.