CVE-2026-86872
Received Received - Intake

Unexpected Behavior in Safari with Malicious Web Content

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: Apple Inc.

Description
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to unexpected behavior.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-86872
EUVD
EUVD-2026-104711

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Apple Safari 0
Apple visionOS 0
Apple watchOS 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

A logic issue in Safari 27, visionOS 27, and watchOS 27 allows processing maliciously crafted web content to lead to unexpected behavior due to improper state management.

Impact Analysis

This vulnerability could allow attackers to manipulate web content in a way that causes unexpected behavior in affected devices, potentially leading to crashes or other unintended actions.

Mitigation Strategies

Update Safari to version 27, visionOS to version 27, and watchOS to version 27 or later to address the logic issue in web content processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86872. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart