CVE-2026-86898unknown
A logic issue was addressed with improved state management.
Impact
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening a maliciously crafted webarchive file may lead to universal cross-site scripting.
Source excerpt · appleAffected packages
This source has no supported package-version data for matching. You can read the advisory here, but this record alone cannot power a dependency check.
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Apple · Safari
| Version / range | Source status |
|---|---|
| 0 to before 27 | affected |
Apple · iOS and iPadOS
| Version / range | Source status |
|---|---|
| 0 to before 27 | affected |
Apple · macOS
| Version / range | Source status |
|---|---|
| 0 to before 27 | affected |
Apple · visionOS
| Version / range | Source status |
|---|---|
| 0 to before 27 | affected |
Original source description
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening a maliciously crafted webarchive file may lead to universal cross-site scripting.