CVE-2026-64713 Overview
CVE-2026-64713 is an information disclosure vulnerability affecting Apple Safari and multiple Apple operating systems. The flaw allows websites to determine whether a user has previously visited a given link, exposing browsing history through an observable discrepancy [CWE-203]. Apple addressed the issue with improved checks across its product ecosystem.
The vulnerability impacts Safari and the underlying WebKit-based browsing components used across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Remote attackers can exploit the issue by luring users to a malicious webpage, requiring user interaction but no privileges.
Critical Impact
A remote website can enumerate a user's link visit history without consent, enabling browser history sniffing, targeted profiling, and deanonymization attacks.
Affected Products
- Apple Safari (versions prior to 26.6)
- Apple iOS and iPadOS (versions prior to 26.6)
- Apple macOS Tahoe (versions prior to 26.6), tvOS, visionOS, and watchOS (versions prior to 26.6)
Discovery Timeline
- 2026-07-27 - CVE-2026-64713 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-64713
Vulnerability Analysis
CVE-2026-64713 is classified under [CWE-203] (Observable Discrepancy). The vulnerability allows a malicious website to determine whether the user has visited a specific link, breaking the privacy boundary that browsers enforce between visited and unvisited link states.
Browsers style visited links differently from unvisited ones. Modern browsers restrict access to this styling information through the DOM and rendering APIs to prevent history sniffing. Apple's advisory indicates the previous implementation contained a discrepancy that a webpage could observe to infer visited-link status.
Successful exploitation lets attackers enumerate a target list of URLs against the victim's browsing history. The information gained can support targeted phishing, deanonymization of anonymous users, and profiling for advertising or intelligence purposes.
Root Cause
The root cause is an observable discrepancy in how the browser processed or rendered visited-link state. The subtle difference in behavior was measurable from JavaScript running on an attacker-controlled page. Apple states the fix consists of improved checks that eliminate the observable difference.
Attack Vector
Exploitation requires the victim to visit an attacker-controlled webpage. The malicious page loads or references a list of target URLs and uses the observable discrepancy to test each URL against the browser's history. No authentication or elevated privileges are required. The attack works over the network against any user running an unpatched Safari or Apple OS.
For technical details on the fix, refer to the vendor advisories: Apple Security Advisory #128066, Apple Security Advisory #128067, and Apple Security Advisory #128068.
Detection Methods for CVE-2026-64713
Indicators of Compromise
- Outbound web traffic from Apple devices to pages that iterate through large lists of target URLs in short intervals.
- JavaScript on visited pages that programmatically queries computed styles or timing signals against many URLs.
- Beaconing telemetry containing enumerated URL/hash pairs sent back to attacker-controlled infrastructure.
Detection Strategies
- Inventory Apple endpoints and compare installed Safari and OS build numbers against fixed versions 26.6.
- Inspect web proxy logs for pages loading unusually large numbers of hidden anchor elements or performing style/layout probing loops.
- Correlate browser telemetry with threat intelligence feeds identifying history-sniffing scripts and tracker frameworks.
Monitoring Recommendations
- Track patch compliance for Safari 26.6, iOS/iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6 across managed fleets.
- Monitor endpoint DNS and HTTP telemetry for connections to newly registered or low-reputation domains hosting suspicious JavaScript.
- Alert on anomalous browser process behavior originating from targeted user populations such as executives and privacy-sensitive roles.
How to Mitigate CVE-2026-64713
Immediate Actions Required
- Update Safari to version 26.6 on all supported macOS releases.
- Upgrade iOS and iPadOS devices to 26.6, and update macOS Tahoe, tvOS, visionOS, and watchOS to 26.6.
- Push updates through MDM to enforce compliance across managed Apple fleets.
- Communicate the risk of browser history sniffing to high-value users and instruct them to avoid untrusted sites until patched.
Patch Information
Apple resolved CVE-2026-64713 with improved checks in Safari 26.6, iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. Full details are available in the vendor advisories: Apple Security Advisory #128069, Apple Security Advisory #128070, and Apple Security Advisory #128073.
Workarounds
- Disable JavaScript in Safari for high-risk browsing sessions via Settings > Safari > Advanced.
- Route sensitive browsing through private browsing windows, which do not persist history and reduce exposure.
- Use content-blocking extensions and enterprise web filtering to block known history-sniffing scripts and trackers.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
