CVE-2026-64778 Overview
CVE-2026-64778 is an information disclosure vulnerability affecting Apple Safari, iOS, iPadOS, and macOS. A maliciously crafted website can leak sensitive data when visited by an affected browser. Apple addressed the flaw with improved input validation checks. The weakness is classified under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor). Exploitation requires user interaction, specifically navigation to attacker-controlled content, but no authentication or elevated privileges. Apple has released fixes in Safari 26.6.1, iOS 18.7.10, iPadOS 18.7.10, iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2.
Critical Impact
Visiting a maliciously crafted website may leak sensitive browser or system data to a remote attacker without authentication.
Affected Products
- Apple Safari (prior to 26.6.1)
- Apple iOS and iPadOS (prior to 18.7.10 and 26.6.1)
- Apple macOS Tahoe (prior to 26.6.2)
Discovery Timeline
- 2026-08-17 - CVE-2026-64778 published to NVD
- 2026-08-18 - Last updated in NVD database
Technical Details for CVE-2026-64778
Vulnerability Analysis
CVE-2026-64778 stems from insufficient validation checks in Apple's browser rendering stack shared across Safari, iOS, iPadOS, and macOS. The vulnerability enables an attacker-controlled webpage to obtain sensitive information that should remain isolated from the origin loading the page. Apple's advisory notes the issue was addressed with improved checks, indicating a missing or weak validation step in code paths handling web content.
The flaw falls under [CWE-200], covering exposure of sensitive information to unauthorized actors. Attackers can use this class of weakness to exfiltrate cross-origin data, memory contents, or environment metadata that normally support browser security boundaries.
Root Cause
The root cause is inadequate validation within web content processing routines. Without complete checks, the browser can return data to script or markup running under a hostile origin. Apple's fix introduces additional guard conditions, closing the disclosure channel.
Attack Vector
The attack vector is network-based and requires user interaction. A victim must load a page controlled by the attacker. No credentials or prior access are required. Because Safari and WebKit ship as the default browser engine on iOS and iPadOS, phishing links, malicious ads, or compromised sites reach a broad user base. Successful exploitation yields confidentiality impact only; integrity and availability are not affected.
No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-64778
Indicators of Compromise
- Outbound requests from Safari or WebKit processes to unfamiliar domains immediately after visiting an untrusted link.
- Browser telemetry showing repeated navigations to domains hosting obfuscated JavaScript or unusual iframe structures.
- Endpoint logs indicating Safari or WebContent processes accessing data outside of expected origins.
Detection Strategies
- Inventory Apple endpoints and identify devices running Safari, iOS, iPadOS, or macOS builds older than the patched versions listed in Apple's advisories.
- Correlate web proxy logs with threat intelligence feeds to flag known malicious sites targeting WebKit users.
- Monitor for anomalous cross-origin data exfiltration patterns from managed browsers.
Monitoring Recommendations
- Enable centralized logging of browser version and OS build data through mobile device management (MDM) tooling.
- Alert on Safari or WebKit crashes and renderer anomalies that may accompany exploitation attempts.
- Track user reports of unexpected redirects, credential prompts, or content changes on trusted sites.
How to Mitigate CVE-2026-64778
Immediate Actions Required
- Update Safari to version 26.6.1 on affected macOS systems.
- Upgrade iPhone and iPad devices to iOS 18.7.10, iPadOS 18.7.10, iOS 26.6.1, or iPadOS 26.6.1 as applicable.
- Upgrade macOS Tahoe devices to version 26.6.2.
- Enforce updates fleet-wide via MDM and verify compliance reporting.
Patch Information
Apple has published fixed versions and advisory details across four support articles: Apple Support Article #148281, Apple Support Article #148282, Apple Support Article #148286, and Apple Support Article #148287. Apply the appropriate update for each platform in the environment.
Workarounds
- Restrict browsing to trusted sites and block known malicious domains at the network egress layer until patches are deployed.
- Deploy web filtering and DNS-layer controls to reduce exposure to untrusted content.
- Disable JavaScript in Safari for high-risk user groups where operationally feasible until updates are installed.
# Verify Safari version on macOS
mdls -name kMDItemVersion /Applications/Safari.app
# Trigger software update check on macOS
sudo softwareupdate --list
sudo softwareupdate --install --all --restart
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
