CVE-2026-113952

Received Received - Intake

Logic Issue in Safari Allows Media Bypass in Lockdown Mode

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: Apple Inc.

Description

A logic issue was addressed with improved checks. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2. A website may be able to use a media format that should be restricted in Lockdown Mode.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-26

Last Modified

2026-10-26

Generated

2026-10-27

AI Q&A

2026-10-27

EPSS Evaluated

N/A

NVD

CVE-2026-113952

EUVD

EUVD-2026-110371

Affected Vendors & Products

Vendor	Product	Version / Range
Apple	Safari	0
Apple	iOS and iPadOS	0
Apple	iOS and iPadOS	0
Apple	macOS	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a logic issue in Apple's software that allows a website to bypass restrictions in Lockdown Mode. It specifically involves media formats that should be blocked but can still be used due to insufficient checks.

Impact Analysis

If you use Lockdown Mode on your Apple device, this vulnerability could allow malicious websites to bypass security restrictions, potentially exposing your device to unauthorized media content or other security risks.

Mitigation Strategies

Update Safari to version 27.2 or later, iOS and iPadOS to 26.7.2 or 27.2 or later, and macOS Golden Gate to 27.2 or later to address the logic issue affecting Lockdown Mode.

Hi! I’m here to help you understand CVE-2026-113952. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70