CVE-2026-84635: Apple Safari DOS Vulnerability

CVE-2026-84635 Overview

CVE-2026-84635 is a logic flaw affecting Apple's WebKit-based browser engine across Safari and multiple Apple operating systems. Processing maliciously crafted web content can trigger an unexpected process termination, resulting in a denial-of-service condition on the affected client. Apple addressed the issue through improved state management in Safari 27, iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. The vulnerability is classified under [CWE-843] (Access of Resource Using Incompatible Type — Type Confusion). No public exploit or in-the-wild exploitation has been reported.

Critical Impact
A remote attacker hosting crafted web content can cause targeted Apple client applications to terminate unexpectedly, disrupting browsing sessions and dependent workflows across iOS, macOS, and other Apple platforms.

Affected Products

Apple Safari (prior to version 27)
Apple iOS and iPadOS (prior to version 27)
Apple macOS Golden Gate (prior to version 27), tvOS 27, visionOS 27, and watchOS 27

Discovery Timeline

2026-09-14 - CVE-2026-84635 published to the National Vulnerability Database
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-84635

Vulnerability Analysis

CVE-2026-84635 stems from a logic issue in how the browser engine tracks internal state while processing web content. When a page delivers a specific sequence of operations, the engine reaches an inconsistent state that the runtime cannot safely handle. The result is an unexpected process termination that impacts availability but does not expose data or allow code execution. Apple's advisory language and the assigned weakness ([CWE-843]) indicate the underlying condition involves accessing a resource using an incompatible type, a class of defect commonly triggered by JavaScript objects transitioning through unexpected shapes.

Root Cause

The root cause is improper state tracking within the affected component. Under certain input conditions, the engine assumes an object or resource is one type while another code path treats it as a different type. This inconsistency violates internal invariants and drives the process into an unrecoverable state, causing termination. Apple's fix introduces stricter state management to keep the engine's assumptions aligned across concurrent code paths.

Attack Vector

Exploitation requires a victim to render attacker-controlled web content. An attacker delivers a crafted page through a website they control, a compromised site, a malicious ad, or a link sent via email or messaging. When the target's Safari or WebKit-based application processes the page, the logic flaw triggers and the process terminates. No user interaction beyond visiting the page is required, and no authentication to the target device is needed.

Because verified proof-of-concept code has not been published, this article does not include exploitation code. Refer to the Apple advisories listed below for vendor-provided technical context.

Detection Methods for CVE-2026-84635

Indicators of Compromise

Repeated unexpected crashes of Safari or WebKit-hosted processes (com.apple.WebKit.WebContent) on updated user endpoints.
Crash reports generated in ~/Library/Logs/DiagnosticReports/ referencing WebKit or JavaScriptCore frames close in time to browsing activity.
Outbound connections to newly observed or low-reputation domains immediately preceding browser process termination.

Detection Strategies

Correlate endpoint crash telemetry for Safari and WebKit processes against browsing history and proxy logs to identify pages that consistently trigger termination.
Alert on abnormal rates of WebKit content-process crashes across a user population, which may indicate a widely served malicious page.
Track Safari version telemetry across the fleet to identify hosts still running pre-27 builds that remain exposed.

Monitoring Recommendations

Ingest macOS unified logs and diagnostic crash reports into a centralized data store for retention and search.
Monitor web proxy and DNS logs for user visits to unfamiliar domains immediately before browser crash events.
Track patch compliance for Safari 27, iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27.

How to Mitigate CVE-2026-84635

Immediate Actions Required

Upgrade affected Apple devices to Safari 27, iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, or watchOS 27 as applicable.
Prioritize patching for users who routinely browse untrusted content or handle high-value data.
Communicate to users that they should avoid opening unsolicited links until their devices are updated.

Patch Information

Apple has published fixes in the following advisories: Apple Support Article #149034, Apple Support Article #149035, Apple Support Article #149036, Apple Support Article #149037, Apple Support Article #149038, and Apple Support Article #149039. Each advisory maps to the corresponding operating system or Safari update that contains the improved state management fix.

Workarounds

Restrict browsing to trusted sites and enable network-level filtering of high-risk categories until updates are deployed.
Enforce Mobile Device Management (MDM) policies that require the fixed OS and Safari versions before granting access to corporate resources.
Consider temporary use of an alternate, patched browser on macOS for users who cannot immediately upgrade Safari.

bash

# Verify installed Safari version on macOS
defaults read /Applications/Safari.app/Contents/Info.plist CFBundleShortVersionString

# Check installed macOS version
sw_vers -productVersion