CVE-2026-86922: Apple Safari vulnerability

Q: What does an attacker need to exploit this issue?

The attacker needs to cause the target to process maliciously crafted web content. Successful exploitation may result in arbitrary code execution.

Q: Which Apple platforms include a fix?

The issue is fixed in Safari 27, iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27.

Published Oct 20, 2026

Updated

A type confusion issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Processing maliciously crafted web content may lead to arbitrary code execution.

Affected Software

5 affected components

Apple Safari<27

Apple iOS<27

Apple iPadOS<27

Apple macOS Golden Gate<27

Apple visionOS<27

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Safari to a version that resolves this vulnerability.
Fixed in 27
Upgrade
Upgrade iOS to a version that resolves this vulnerability.
Fixed in 27
Upgrade
Upgrade iPadOS to a version that resolves this vulnerability.
Fixed in 27
Upgrade
Upgrade macOS Golden Gate to a version that resolves this vulnerability.
Fixed in 27
Upgrade
Upgrade visionOS to a version that resolves this vulnerability.
Fixed in 27

Event History

Oct 20, 2026

CVE Published

via MITRE·12:50 AM

Data Sourced

via MITRE·12:50 AM

DescriptionWeakness

Data Sourced

via NVD·01:17 AM

Description

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker needs to cause the target to process maliciously crafted web content. Successful exploitation may result in arbitrary code execution.

Which Apple platforms include a fix?