medium5.4
CVE-2026-86898
A logic issue was addressed with improved state management.
Impact
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening a maliciously crafted webarchive file may lead to universal cross-site scripting.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apple | Safari | before 27.0 |
| Apple | Ipados | before 27.0 |
| Apple | Iphone Os | before 27.0 |
| Apple | Macos | before 27.0 |
| Apple | Visionos | before 27.0 |