CVE-2026-86898

Name of the Vulnerable Software and Affected Versions Safari versions prior to 27 iOS versions prior to 27 iPadOS versions prior to 27 macOS Golden Gate versions prior to 27 visionOS versions prior to 27

Description A logic issue involving state management allows for universal cross-site scripting (uXSS), a type of vulnerability where an attacker can execute malicious scripts across different origins on a browser. This occurs when a user opens a maliciously crafted webarchive file.

Recommendations Update Safari to version 27. Update iOS to version 27. Update iPadOS to version 27. Update macOS Golden Gate to version 27. Update visionOS to version 27.