CVE-2026-86898

Undergoing Analysis Undergoing Analysis - In Progress

Universal XSS in Apple Safari and iOS via Malicious Webarchive File

Publication date: 2026-09-14

Last updated on: 2026-09-18

Assigner: Apple Inc.

Description

A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening a maliciously crafted webarchive file may lead to universal cross-site scripting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-18

Generated

2026-10-05

AI Q&A

2026-09-15

EPSS Evaluated

2026-10-04

NVD

CVE-2026-86898

Affected Vendors & Products

Vendor	Product	Version / Range
apple	ipados	to 27.0 (exc)
apple	iphone_os	to 27.0 (exc)
apple	macos	to 27.0 (exc)
apple	visionos	to 27.0 (exc)
apple	safari	to 27.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a logic issue in Apple's software that allows universal cross-site scripting when a maliciously crafted webarchive file is opened. It was fixed in Safari 27, iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27.

Detection Guidance

This vulnerability involves a logic issue in Safari and related Apple products that could allow universal cross-site scripting via a maliciously crafted webarchive file. Detection primarily involves checking for the affected software versions and inspecting files or network traffic for suspicious webarchive files. No specific commands are provided in the context to directly detect this issue.

Impact Analysis

Opening a malicious webarchive file could allow an attacker to execute malicious scripts in your browser, potentially stealing data, session cookies, or performing actions on your behalf without your knowledge.

Compliance Impact

The vulnerability involves universal cross-site scripting via maliciously crafted webarchive files, which could allow unauthorized access to user data or session hijacking. This may impact compliance with GDPR by risking unauthorized data exposure or processing, and with HIPAA by potentially compromising protected health information if exploited in healthcare contexts.

Mitigation Strategies

Update affected Apple products to the latest versions: Safari 27, iOS 27, iPadOS 27, macOS Golden Gate 27, or visionOS 27. Avoid opening untrusted webarchive files until the update is applied.

Hi! I’m here to help you understand CVE-2026-86898. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70