Product:
Safari
Summary
This issue was addressed through improved state management. Processing maliciously crafted web content may prevent Content Security Policy from being enforced. The issue has been fixed in multiple Apple operating systems and applications.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.5 | CVE-2026-20665 |
Exploitation
An attacker can exploit this vulnerability by crafting malicious web content that, when processed by the affected version of Safari, bypasses the Content Security Policy. This could allow unauthorized access to sensitive information or manipulation of the web application’s behavior without user interaction.
Affected Products
- Safari: A web browser that may allow bypassing of Content Security Policy.
- iOS: Mobile operating system with affected versions that may be vulnerable to web content exploitation.
- iPadOS: Operating system for iPads that may also be affected by this vulnerability.
- macOS Tahoe: Desktop operating system with potential vulnerabilities in web content processing.
- tvOS: Operating system for Apple TV that may be impacted by this issue.
- visionOS: Operating system for augmented reality devices that could be affected.
- watchOS: Operating system for Apple Watch that may also be vulnerable.
Mitigation
To mitigate this vulnerability, users should update their devices to the latest versions of Safari and the respective operating systems. Regularly applying security updates and patches is essential to protect against potential exploits.