CVE-2026-86922
8.8HighPublished 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-843
Impact
Remote attackers can execute arbitrary code on the device if a user processes maliciously crafted web content. The attacker needs the user to visit a malicious webpage or render crafted web content.
Root cause
A type confusion bug in web content processing caused by improper state management.
Affected systems
Versions prior to Safari 27, iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade to Safari 27, iOS 27, iPadOS 27, macOS Golden Gate 27, or visionOS 27. No interim workaround is provided in the advisory.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A type confusion issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Processing maliciously crafted web content may lead to arbitrary code execution.