CVE-2026-65390: Apple Safari Buffer Overflow Vulnerability

CVE-2026-65390 Overview

CVE-2026-65390 is an integer overflow vulnerability [CWE-190] affecting Apple's web content processing stack across Safari and multiple operating systems. Processing maliciously crafted web content can trigger memory corruption on vulnerable devices. Apple addressed the flaw with improved input validation in Safari 26.6.1, iOS 26.6.1, iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, and watchOS 27. The vulnerability requires user interaction, typically visiting a malicious website, and can be exploited over the network without authentication.

Critical Impact
Successful exploitation can lead to memory corruption during web content processing, creating a foundation for arbitrary code execution within the browser rendering process.

Affected Products

Apple Safari (prior to 26.6.1)
Apple iOS and iPadOS (prior to 26.6.1)
Apple macOS Tahoe (prior to 26.6.2), tvOS (prior to 27), visionOS (prior to 27), and watchOS (prior to 27)

Discovery Timeline

2026-09-14 - CVE-2026-65390 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-65390

Vulnerability Analysis

The vulnerability is an integer overflow in Apple's web content processing pipeline used by Safari and system WebKit-backed components. When the renderer parses attacker-controlled input, an arithmetic operation exceeds the bounds of its integer type. The resulting truncated or wrapped value is then used in downstream memory allocation or indexing logic. This mismatch between the requested and actual buffer size produces memory corruption in the process handling the web content. Apple's advisory notes the fix is improved input validation, indicating the flawed code path failed to sanitize numeric inputs before use in size calculations.

Root Cause

The root cause is insufficient validation of integer values derived from untrusted web content. Numeric fields influencing buffer size or offset calculations were not bounded before arithmetic operations, allowing wraparound. Subsequent memory operations then read or write beyond the intended allocation, corrupting adjacent heap structures.

Attack Vector

An attacker hosts a crafted webpage or delivers malicious content through an embedded frame or advertisement network. When a user opens the page in Safari or an application using the system web view, the parser triggers the overflow. Exploitation requires user interaction but no authentication, and can be delivered entirely over the network. Chained with a sandbox escape, the primitive can lead to code execution outside the browser context.

// No verified proof-of-concept is publicly available for CVE-2026-65390.
// Refer to Apple's security advisories for vendor-supplied technical context.

Detection Methods for CVE-2026-65390

Indicators of Compromise

Unexpected Safari or WebKit process crashes with signals such as SIGSEGV or SIGBUS recorded in system diagnostic reports.
Creation of new launch agents, login items, or persistence artifacts shortly after web browsing sessions.
Outbound network connections from com.apple.WebKit.WebContent or Safari to previously unseen domains hosting exploit payloads.

Detection Strategies

Monitor endpoint telemetry for anomalous child processes spawned by Safari or WebKit content processes.
Correlate browser crash reports with visited URLs to identify possible exploit delivery pages.
Deploy web filtering to block domains associated with known WebKit exploit kits and drive-by download infrastructure.

Monitoring Recommendations

Ingest macOS and iOS crash logs into a centralized data lake for retrospective analysis of memory corruption patterns.
Alert on execution of unsigned binaries or scripts following Safari activity within a short time window.
Track OS and Safari version inventory to identify unpatched endpoints exposed to CVE-2026-65390.

How to Mitigate CVE-2026-65390

Immediate Actions Required

Update Safari to 26.6.1 and upgrade iOS and iPadOS to 26.6.1 on all managed devices.
Upgrade macOS to Tahoe 26.6.2, and update tvOS, visionOS, and watchOS to version 27.
Enforce automatic updates through mobile device management (MDM) to prevent version drift.
Restrict browsing to trusted sites on devices that cannot be patched immediately.

Patch Information

Apple published fixes across six advisories corresponding to each affected platform. Refer to Apple Support Article 148281, Apple Support Article 148282, Apple Support Article 148286, Apple Support Article 149036, Apple Support Article 149037, and Apple Support Article 149038 for platform-specific version details.

Workarounds

Disable JavaScript for untrusted sites using Safari's per-site settings until patches are applied.
Use content-filtering DNS or a secure web gateway to block known-malicious domains.
Enable Lockdown Mode on iOS, iPadOS, and macOS for high-risk users to reduce the WebKit attack surface.

bash

# Verify installed Safari version on macOS
mdls -name kMDItemVersion /Applications/Safari.app

# Trigger software update check via MDM or command line
sudo softwareupdate --install --all --restart