AppleCVE-2026-86872

Apple Safari: type confusion

CVE-2026-86872 · Published Oct 20, 2026 · updated Nov 9, 2026

Medium5.4

Fix: upgrade to 27 or later (3 fixed versions below)

A logic issue was addressed with improved state management. This issue is fixed in Safari 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to unexpected behavior.

Affected versions

Package	Affected	Fixed in
Safari Product	< 27	27
visionOS Product	< 27	27
watchOS Product	< 27	27

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Severity from: CISA (its enrichment of the CVE record)
Weakness: CWE-843

More Apple advisories

All Apple

High 7.5Oct 20

Apple iOS and iPadOS: improper authorizationCVE-2026-86977fixed in 27 Medium 5.5Oct 20

Apple macOS: information disclosureCVE-2026-86979fixed in 27 Medium 5.5Oct 20

Apple macOS: out-of-bounds writeCVE-2026-86981fixed in 15.8 +1 Medium 5.5Oct 20

Apple iOS and iPadOS: improper authorizationCVE-2026-86976fixed in 27 +1 Medium 5.9Oct 20

Apple iOS and iPadOS: denial of serviceCVE-2026-86963fixed in 26.7 +1 Medium 4.3Oct 20

Apple iOS and iPadOS: out-of-bounds readCVE-2026-86975fixed in 27 +2