CVE-2026-64753: Apple Safari Information Disclosure Flaw

CVE-2026-64753 Overview

CVE-2026-64753 is an information disclosure vulnerability affecting Apple Safari and multiple Apple operating systems. The flaw stems from a permissions issue in web content processing, which Apple addressed by removing the vulnerable code. Processing maliciously crafted web content may disclose sensitive user information to an attacker.

The vulnerability is categorized under [CWE-269] Improper Privilege Management. It requires user interaction, such as visiting a malicious website, but no authentication or elevated privileges. The issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27.

Critical Impact
A remote attacker can trick a user into loading crafted web content to disclose sensitive user information across Safari and all major Apple operating systems.

Affected Products

Apple Safari (prior to Safari 27)
Apple iOS and iPadOS (prior to version 27)
Apple macOS Golden Gate (prior to version 27), tvOS 27, visionOS 27, and watchOS 27

Discovery Timeline

2026-09-14 - CVE-2026-64753 published to the National Vulnerability Database (NVD)
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-64753

Vulnerability Analysis

CVE-2026-64753 is an improper privilege management flaw [CWE-269] in Apple's web content handling stack. Apple's advisories indicate that processing maliciously crafted web content may disclose sensitive user information. The attack vector is network-based and requires user interaction, such as visiting an attacker-controlled page in Safari.

Apple resolved the issue by removing the vulnerable code path entirely rather than adding permission checks. This approach eliminates the affected functionality that permitted unauthorized access to sensitive data during web content processing. The fix ships across Safari 27, iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27.

Root Cause

The root cause is a permissions issue in a component reachable from web content processing. A code path failed to enforce proper privilege boundaries, allowing crafted web content to reach data that should have been isolated from the renderer context. Because the fix removes the vulnerable code, the underlying capability is no longer exposed to web content.

Attack Vector

Exploitation requires a user to visit a malicious or compromised website using an unpatched Apple browser or WebKit-based application. No credentials or prior access to the device are required. Successful exploitation results in disclosure of sensitive user information, without direct integrity or availability impact.

No public proof-of-concept exploit code is available for CVE-2026-64753, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Refer to the Apple Support advisories for platform-specific technical details.

Detection Methods for CVE-2026-64753

Indicators of Compromise

No vendor-published indicators of compromise or malware artifacts are associated with CVE-2026-64753 at this time.
Suspicious outbound HTTP(S) requests from Safari or WebKit-based applications to newly registered or low-reputation domains shortly after page loads.
Anomalous data egress patterns from user endpoints browsing unfamiliar sites on unpatched Apple OS versions.

Detection Strategies

Inventory Apple endpoints and identify systems running Safari, iOS, iPadOS, macOS, tvOS, visionOS, or watchOS versions earlier than 27.
Correlate browser telemetry with web proxy logs to identify users visiting untrusted sites from unpatched devices.
Monitor mobile device management (MDM) compliance reports to flag devices missing the September 2026 Apple security updates.

Monitoring Recommendations

Track Apple OS and Safari version compliance through MDM platforms such as Jamf, Intune, or Kandji.
Alert on endpoints that remain on pre-version-27 Apple software beyond a defined patch window.
Review web gateway logs for user interactions with domains flagged by threat intelligence feeds.

How to Mitigate CVE-2026-64753

Immediate Actions Required

Update Safari to version 27 and upgrade Apple operating systems to iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27.
Prioritize patching for user-facing endpoints, executives, and high-value accounts that regularly browse external content.
Enforce update compliance through MDM policies and block non-compliant devices from accessing sensitive corporate resources.

Patch Information

Apple has published security advisories describing the fix across affected platforms. Refer to Apple's official guidance: Apple Support Article #149034, Apple Support Article #149035, Apple Support Article #149036, Apple Support Article #149037, Apple Support Article #149038, and Apple Support Article #149039.

Workarounds

No vendor-supplied workarounds are documented; upgrading to the fixed versions is the recommended remediation.
Restrict browsing on unpatched devices to trusted internal sites through web proxy policies until updates are applied.
Educate users to avoid clicking untrusted links on Apple devices that have not yet received the September 2026 security updates.

bash

# Verify installed Safari version on macOS
mdls -name kMDItemVersion /Applications/Safari.app

# Trigger software update check on macOS
sudo softwareupdate --list
sudo softwareupdate --install --all --restart