CVE-2026-64730: Apple Safari UI Spoofing Vulnerability

CVE-2026-64730 Overview

CVE-2026-64730 is a user interface (UI) spoofing vulnerability affecting Apple Safari and multiple Apple operating systems. The flaw allows a website that frames malicious content to render deceptive UI elements to the user. Apple addressed the issue through improved UI handling in Safari 26.6, iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. The vulnerability is classified under [CWE-451] (User Interface Misrepresentation of Critical Information) and requires user interaction to exploit.

Critical Impact
An attacker-controlled website that frames malicious content can spoof UI elements, potentially tricking users into interacting with fraudulent content that appears to originate from a trusted source.

Affected Products

Apple Safari (prior to 26.6)
Apple iOS and iPadOS (prior to 26.6)
Apple macOS Tahoe (prior to 26.6)
Apple tvOS, visionOS, and watchOS (prior to 26.6)

Discovery Timeline

2026-07-27 - CVE-2026-64730 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-64730

Vulnerability Analysis

CVE-2026-64730 is a UI spoofing vulnerability rooted in how Safari and WebKit-based Apple platforms render framed content. When a webpage embeds malicious content inside a frame, the browser fails to clearly communicate the true origin or trust boundary of the framed material. Attackers can exploit this ambiguity to overlay or render fake UI elements that impersonate legitimate browser chrome, dialogs, or origin indicators.

The issue falls under [CWE-451], where the interface fails to accurately represent security-relevant information. Users are the primary target because the spoofed UI can lead to credential disclosure, unintended actions, or misplaced trust in the framed content. Apple's fix addresses the flaw with improved UI rendering logic across all affected platforms.

Root Cause

The root cause is insufficient isolation and visual separation between top-level page content and content rendered inside an iframe. Safari's UI rendering did not adequately convey the boundary between the framing site and the framed content, enabling attackers to construct visually deceptive layouts. The flaw does not corrupt memory or execute code; it manipulates the user's perception of the browser's trust indicators.

Attack Vector

Exploitation requires a victim to visit an attacker-controlled or compromised website that embeds a malicious frame. The attack is network-based, requires low complexity, and no privileges, but does require user interaction. No confidentiality or availability impact occurs directly, but integrity is affected because the user may act on falsified UI content. The vulnerability is well-suited for phishing and social engineering campaigns rather than traditional exploitation chains.

No public proof-of-concept has been observed, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Apple Security Update Advisory for technical details.

Detection Methods for CVE-2026-64730

Indicators of Compromise

Web traffic to unfamiliar domains that host iframes referencing high-value brands, banking portals, or authentication providers.
User reports of unexpected login prompts, permission dialogs, or address bar inconsistencies while browsing.
Phishing landing pages that embed legitimate-looking framed content combined with overlay UI.

Detection Strategies

Monitor endpoint browser versions to identify Safari and Apple OS builds still below 26.6.
Correlate proxy or DNS logs for known phishing infrastructure that leverages iframe-based content delivery.
Inspect user-reported phishing samples for HTML structures that mix cross-origin frames with spoofed browser chrome.

Monitoring Recommendations

Track patch compliance for Safari and all Apple operating systems across managed fleets.
Alert on repeated user interaction with domains flagged by threat intelligence feeds for UI spoofing or phishing.
Log and review MDM inventory reports to confirm Apple devices are running the updated builds.

How to Mitigate CVE-2026-64730

Immediate Actions Required

Update Safari and all Apple devices to version 26.6 or later immediately.
Push updates to managed Apple devices through Mobile Device Management (MDM) enforcement policies.
Educate users about UI spoofing risks and encourage verification of URLs before entering credentials.

Patch Information

Apple resolved CVE-2026-64730 in Safari 26.6, iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. Refer to the vendor advisories for platform-specific update instructions: Safari and iOS/iPadOS Advisory, macOS Tahoe Advisory, tvOS Advisory, visionOS Advisory, watchOS Advisory, and additional Apple Advisory.

Workarounds

Restrict browsing to trusted sites and avoid interacting with unsolicited framed dialogs or login prompts.
Deploy web filtering and DNS-layer controls to block known phishing infrastructure.
Configure MDM policies to prevent installation of untrusted browser extensions that could amplify spoofing risk.

bash

# Verify Safari version on macOS
defaults read /Applications/Safari.app/Contents/Info.plist CFBundleShortVersionString

# Check macOS build version
sw_vers -productVersion