This issue was addressed with improved input validation. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2. Processing maliciously crafted web content may lead to an unexpected process crash.
CVE-2026-86985
CVSS base score
6.5 (v3.1)
Severity
MEDIUM
Attack vector
Network
Weakness
CWE-20
Last modified
November 4, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
apple safari
apple ipados
apple iphone os
apple macos
apple tvos
References
- support.apple.com Release Notes, Vendor Advisory
- support.apple.com Release Notes, Vendor Advisory
- support.apple.com Release Notes, Vendor Advisory
- support.apple.com Release Notes, Vendor Advisory
- support.apple.com Release Notes, Vendor Advisory