Product:
macOS, iOS, iPadOS, visionOS, Safari
Summary
This issue was addressed through improved state management. It is fixed in macOS Tahoe 26.3, iOS 18.7.5, iPadOS 18.7.5, visionOS 26.3, and Safari 26.3. Processing maliciously crafted web content may lead to an unexpected process crash.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.5 | CVE-2026-20608 |
Exploitation
To exploit this vulnerability, an attacker must craft malicious web content that, when processed by the affected product, can trigger an unexpected process crash. This requires local access to the device and user interaction to open the malicious content.
Affected Products
- macOS Tahoe: Affected by the vulnerability leading to potential crashes when processing malicious web content.
- iOS: Vulnerable versions may experience unexpected crashes due to crafted web content.
- iPadOS: Similar vulnerabilities as iOS, leading to crashes from malicious content.
- visionOS: Affected by the same issues as other operating systems, resulting in crashes.
- Safari: The web browser is susceptible to crashes from maliciously crafted web content.
Mitigation
To mitigate this issue, users should update their devices to the latest versions of macOS, iOS, iPadOS, visionOS, and Safari. Regularly applying updates helps protect against known vulnerabilities and enhances overall security.