Apple Safari vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Apple Safari: 214 record(s), with affected versions and fixes.cpe:2.3:a:apple:safari
CVE-2026-28883
High · 7.5
CWE-416 May 11, 2026
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS...
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.
CVE-2026-28847
High · 8.8
CWE-119 May 11, 2026
The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and...
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.
CVE-2026-28871
Medium · 4.3
CWE-79 Mar 24, 2026
Cross-site Scripting (XSS) in Apple Safari
A logic issue was addressed with improved checks. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4. Visiting a maliciously crafted website may lead to a cross-site scripting attack.
CVE-2026-28861
Medium · 4.3
CWE-79 Mar 24, 2026
Cross-site Scripting (XSS) in Apple Safari
A logic issue was addressed with improved state management. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. A malicious website may be able to access script message handlers intended for other origins.
CVE-2026-28859
Medium · 4.3
CWE-125 Mar 24, 2026
Out-of-bounds Read in Apple Safari
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. A malicious website may be able to process restricted web content outside the sandbox.
CVE-2026-28857
Medium · 6.5
CWE-125 Mar 24, 2026
Out-of-bounds Read in Apple Safari
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processing maliciously crafted web content may lead to an unexpected process crash.
CVE-2026-20691
Medium · 4.3
CWE-497 Mar 24, 2026
An authorization issue was addressed with improved state management. This issue is fixed…
An authorization issue was addressed with improved state management. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4, watchOS 26.4. A maliciously crafted webpage may be able to fingerprint the user.
CVE-2026-20665
Medium · 6.5
CWE-693 Mar 24, 2026
This issue was addressed through improved state management. This issue is fixed in…
This issue was addressed through improved state management. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.
CVE-2026-20664
Medium · 4.3
CWE-787 Mar 24, 2026
Out-of-bounds Write in Apple Safari
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processing maliciously crafted web content may lead to an unexpected process crash.
CVE-2026-20643
Medium · 5.4
CWE-20 Mar 17, 2026
Improper Input Validation in Apple Ipados
A cross-origin issue in the Navigation API was addressed with improved input validation. This issue is fixed in Background Security Improvements for iOS, iPadOS, and macOS, Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processing maliciously crafted web content may bypass Same Origin Policy.
CVE-2023-43010
High · 8.8
CWE-787 Mar 11, 2026
Out-of-bounds Write in Apple Safari
The issue was addressed with improved memory handling. This issue is fixed in iOS 17.2 and iPadOS 17.2, macOS Sonoma 14.2, Safari 17.2, iOS 16.7.15 and iPadOS 16.7.15, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption.
CVE-2026-20676
Medium · 5.3
CWE-400 Feb 11, 2026
Uncontrolled Resource Consumption in Apple Safari
This issue was addressed through improved state management. This issue is fixed in Safari 26.3, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. A website may be able to track users through Safari web extensions.
CVE-2026-20660
High · 7.5
CWE-22 Feb 11, 2026
Path Traversal in Apple Safari
A path handling issue was addressed with improved logic. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.5, macOS Sonoma 14.8.4, macOS Tahoe 26.3, visionOS 26.3. A remote user may be able to write arbitrary files.
CVE-2026-20656
Low · 3.3
CWE-285 Feb 11, 2026
Improper Authorization in Apple Safari
A logic issue was addressed with improved validation. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, macOS Tahoe 26.3. An app may be able to access a user's Safari history.
CVE-2026-20652
High · 7.5
CWE-400 Feb 11, 2026
Uncontrolled Resource Consumption in Apple Safari
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. A remote attacker may be able to cause a denial-of-service.
CVE-2026-20644
Medium · 6.5
CWE-119 Feb 11, 2026
Buffer Errors (Improper Restriction of Operations within Memory Bounds) in Apple Safari
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. Processing maliciously crafted web content may lead to an unexpected process crash.
CVE-2026-20636
Medium · 6.5
CWE-119 Feb 11, 2026
Buffer Errors (Improper Restriction of Operations within Memory Bounds) in Apple Safari
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. Processing maliciously crafted web content may lead to an unexpected process crash.
CVE-2026-20635
Medium · 4.3
CWE-119 Feb 11, 2026
Buffer Errors (Improper Restriction of Operations within Memory Bounds) in Apple Safari
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26.3. Processing maliciously crafted web content may lead to an unexpected process crash.
CVE-2026-20608
Medium · 5.5
CWE-770 Feb 11, 2026
Allocation of Resources Without Limits or Throttling in Apple Safari
This issue was addressed through improved state management. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. Processing maliciously crafted web content may lead to an unexpected process crash.
CVE-2025-46299
Medium · 4.3
CWE-284 Jan 9, 2026
Improper Access Control in Apple Safari
A memory initialization issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may disclose internal states of the app.
CVE-2025-46298
Medium · 6.5
CWE-119 Jan 9, 2026
Buffer Errors (Improper Restriction of Operations within Memory Bounds) in Apple Safari
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may lead to an unexpected process crash.
CVE-2025-46282
Medium · 5.5
CWE-284 Dec 17, 2025
Improper Access Control in Apple Safari
The issue was addressed with additional permissions checks. This issue is fixed in Safari 26.2, macOS Tahoe 26.2. An app may be able to access sensitive user data.
CVE-2025-43536
Medium · 4.3
CWE-416 Dec 17, 2025
Use After Free in Apple Safari
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2. Processing maliciously crafted web content may lead to an unexpected process crash.
CVE-2025-43541
Medium · 4.3
CWE-843 Dec 17, 2025
Type Confusion in Apple Safari
A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
CVE-2025-43535
Medium · 4.3
Dec 17, 2025
The issue was addressed with improved memory handling. This issue is fixed in Safari…
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Processing maliciously crafted web content may lead to an unexpected process crash.