CVE-2026-84518: Apple Safari Information Disclosure Flaw

CVE-2026-84518 Overview

CVE-2026-84518 is an information disclosure vulnerability in Apple Safari, iOS, iPadOS, and macOS. A malicious website can determine which applications a user has installed on their device by abusing improper state management in the browser. Apple addressed the issue through improved state management in Safari 27, iOS 27, iPadOS 27, and macOS Golden Gate 27.

The vulnerability is categorized as [CWE-642] External Control of Critical State Data. Exploitation requires user interaction, such as visiting an attacker-controlled webpage, but no authentication or elevated privileges.

Critical Impact
A remote attacker can enumerate installed applications on a target device, enabling fingerprinting, targeted phishing, and reconnaissance for follow-on attacks.

Affected Products

Apple Safari (versions prior to 27)
Apple iOS and iPadOS (versions prior to 27)
Apple macOS (versions prior to Golden Gate 27)

Discovery Timeline

2026-09-14 - CVE-2026-84518 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-84518

Vulnerability Analysis

The vulnerability resides in how Safari and Apple operating systems manage state information exposed to web content. A malicious website can query or observe browser state, such as URL scheme handler behavior or resource-load side effects, to infer which native applications are installed on the device.

Because the attack executes entirely from a webpage, no exploit code needs to run on the endpoint. The attacker relies on observable differences in browser behavior when the OS resolves application-registered URL schemes or app-linked resources. This class of leak turns per-user application inventory into fingerprintable data.

The disclosed information supports targeted follow-on attacks. An attacker who knows the victim uses specific banking, enterprise, or messaging applications can tailor phishing pages, deliver app-specific exploit payloads, or profile visitors for espionage operations.

Root Cause

The root cause is improper state management in the WebKit/Safari layer, tracked under [CWE-642]. Browser state that should be isolated from untrusted web origins was exposed in a way that allowed inference of installed application identifiers. Apple's remediation states the issue was addressed "through improved state management," restricting what web content can observe.

Attack Vector

Exploitation requires the victim to load attacker-controlled web content in Safari or a WebKit-based view. No credentials or prior access to the device are required. The attacker hosts a page that probes application-related state and reports the results back to a collection server. See the Apple Support Article #149034, #149035, and #149039 for vendor details.

No public proof-of-concept exploit or CISA Known Exploited Vulnerabilities listing is associated with this CVE at publication.

Detection Methods for CVE-2026-84518

Indicators of Compromise

Outbound web requests from Safari to unfamiliar domains containing encoded lists of URL schemes or application identifiers in query parameters or POST bodies.
Repeated, rapid navigation attempts to custom URL schemes (for example banking://, msteams://, slack://) initiated by a single web origin.
Unusual referer chains from ad networks or newly registered domains preceding targeted phishing against the same user.

Detection Strategies

Inspect web proxy and DNS telemetry for pages that trigger bursts of scheme-handler probes shortly after page load.
Correlate Safari process telemetry with subsequent delivery of app-tailored phishing lures to the same identity.
Hunt for JavaScript payloads served over HTTPS that reference long arrays of application URL schemes, a common enumeration pattern.

Monitoring Recommendations

Ingest browser and network telemetry from macOS, iOS, and iPadOS endpoints into a centralized analytics platform for cross-source correlation.
Track Safari version compliance across the managed fleet and alert on devices running versions prior to Safari 27.
Monitor MDM inventory for iOS 27, iPadOS 27, and macOS Golden Gate 27 adoption rates to measure remediation progress.

How to Mitigate CVE-2026-84518

Immediate Actions Required

Update all Apple endpoints to Safari 27, iOS 27, iPadOS 27, or macOS Golden Gate 27 as delivered by Apple Software Update.
Push updates through Mobile Device Management (MDM) to enforce timely patching across managed devices.
Advise users to avoid clicking untrusted links until updates are applied, particularly on shared or high-value devices.

Patch Information

Apple addressed CVE-2026-84518 through improved state management in Safari 27, iOS 27 and iPadOS 27, and macOS Golden Gate 27. Reference the vendor advisories: Apple Support Article #149034, Apple Support Article #149035, and Apple Support Article #149039.

Workarounds

Restrict browsing on unpatched devices to trusted domains using enterprise web filtering or DNS security controls.
Disable or restrict custom URL scheme handlers for applications that are not required on managed devices.
Use MDM configuration profiles to enforce Safari content restrictions and block newly registered or low-reputation domains until patching is complete.

bash

# Configuration example: check installed Safari version on macOS
mdls -name kMDItemVersion /Applications/Safari.app

# Trigger Apple Software Update to fetch pending security updates
sudo softwareupdate --install --all --restart