CVE-2026-64778

EUVD-2026-60488
The issue was addressed with improved checks. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. Visiting a maliciously crafted website may leak sensitive data.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 24.89%
Affected Products (NVD)
VendorProductVersion
applesafari
𝑥
< 26.6.1
appleipados
𝑥
< 18.7.10
appleipados
26.0 ≤
𝑥
< 26.6.1
appleiphone_os
𝑥
< 18.7.10
appleiphone_os
26.0 ≤
𝑥
< 26.6.1
applemacos
26.0 ≤
𝑥
< 26.6.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
webkit2gtk
bookworm
vulnerable
bookworm (security)
vulnerable
forky
vulnerable
sid
2.54.0-1
fixed
trixie
vulnerable
trixie (security)
2.54.0-1~deb13u1
fixed
wpewebkit
bookworm
ignored
forky
2.54.0-2
fixed
sid
2.54.0-2
fixed
trixie
ignored
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
webkit2gtk3
RHEL 8
0:2.54.0-1.el8_10
fixed
RHEL 9
0:2.54.0-1.el9_8
fixed
webkit2gtk3-devel
RHEL 8
0:2.54.0-1.el8_10
fixed
RHEL 9
0:2.54.0-1.el9_8
fixed
webkit2gtk3-jsc
RHEL 8
0:2.54.0-1.el8_10
fixed
RHEL 9
0:2.54.0-1.el9_8
fixed
webkit2gtk3-jsc-devel
RHEL 8
0:2.54.0-1.el8_10
fixed
RHEL 9
0:2.54.0-1.el9_8
fixed
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://support.apple.com/en-us/148281
https://support.apple.com/en-us/148282
https://support.apple.com/en-us/148286
https://support.apple.com/en-us/148287
https://support.apple.com/en-us/149036
https://support.apple.com/en-us/149037
https://support.apple.com/en-us/149038