A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
CVE-2026-86986
CVSS base score
7.5 (v3.1)
Severity
HIGH
Attack vector
Network
Weakness
CWE-416
Last modified
November 4, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
apple safari
apple ipados
apple iphone os
apple macos
apple visionos
References
- support.apple.com Release Notes, Vendor Advisory
- support.apple.com Release Notes, Vendor Advisory
- support.apple.com Release Notes, Vendor Advisory
- support.apple.com Release Notes, Vendor Advisory
- support.apple.com Release Notes, Vendor Advisory