CVE-2026-86898
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening a maliciously crafted webarchive file may lead to universal cross-site scripting.
- Published Sep 14, 2026
- CVSS 5.4 medium
- 0.2% chance of exploitation in the next 30 days (EPSS)
- A fix is available