CVE-2026-64728

Analyzed Analyzed - Analysis Complete

Permissions Issue in Safari 26.6 and Related Systems

Publication date: 2026-07-27

Last updated on: 2026-07-28

Assigner: Apple Inc.

Description

A permissions issue was addressed with improved validation. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Maliciously crafted web content may violate iframe sandboxing policy.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-27

Last Modified

2026-07-28

Generated

2026-08-17

AI Q&A

2026-07-28

EPSS Evaluated

2026-08-15

NVD

CVE-2026-64728

EUVD

EUVD-2026-49488

Affected Vendors & Products

Vendor	Product	Version / Range
apple	macos	From 26.0 (inc) to 26.6 (exc)
apple	ipados	to 26.6 (exc)
apple	iphone_os	to 26.6 (exc)
apple	tvos	to 26.6 (exc)
apple	visionos	to 26.6 (exc)
apple	safari	to 26.6 (exc)
apple	watchos	to 26.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

Executive Summary

This vulnerability is a permissions issue caused by insufficient validation. It allows maliciously crafted web content to bypass iframe sandboxing policies, potentially leading to unauthorized actions within a webpage.

Detection Guidance

This vulnerability involves a permissions issue with iframe sandboxing in Apple software. Detection requires checking installed versions of Safari, iOS, iPadOS, macOS Tahoe, tvOS, visionOS, or watchOS against the patched versions (26.6 or later). No specific commands are provided in the context to detect this issue directly.

Impact Analysis

If exploited, this flaw could let attackers run unauthorized scripts or access sensitive data in an iframe, compromising user privacy or enabling phishing attacks through malicious websites.

Compliance Impact

The vulnerability involves a permissions issue allowing maliciously crafted web content to violate iframe sandboxing policy. This could potentially lead to unauthorized data access or manipulation, which may impact compliance with standards like GDPR or HIPAA if sensitive user data is exposed or altered.

Mitigation Strategies

Update affected Apple products to the latest versions: Safari 26.6, iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. This addresses the permissions issue and prevents malicious web content from violating iframe sandboxing.

Hi! I’m here to help you understand CVE-2026-64728. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70