CVE-2026-64753
published 2026-09-14CVE-2026-64753: A permissions issue was addressed by removing the vulnerable code. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27…
PriorityP334medium6.5CVSS 3.1
AVNACLPRNUIRSUCHINAN
EPSS
0.30%
21.5th percentile
A permissions issue was addressed by removing the vulnerable code. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may disclose sensitive user information.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios_and_ipados | < 27 | 27 |
| apple | ipados | < 27.0 | 27.0 |
| apple | iphone_os | < 27.0 | 27.0 |
| apple | macos | < 27 | 27 |
| apple | macos | < 27.0 | 27.0 |
| apple | safari | < 27 | 27 |
| apple | safari | < 27.0 | 27.0 |
| apple | tvos | < 27 | 27 |
| apple | tvos | < 27.0 | 27.0 |
| apple | visionos | < 27 | 27 |
| apple | visionos | < 27.0 | 27.0 |
| apple | watchos | < 27 | 27 |
| apple | watchos | < 27.0 | 27.0 |
| webkitgtk | webkitgtk | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
webkitgtk: Processing maliciously crafted web content may disclose sensitive user information
vendor_redhat·2026-09-14·CVSS 6.5
CVE-2026-64753 [MEDIUM] CWE-359 webkitgtk: Processing maliciously crafted web content may disclose sensitive user information
webkitgtk: Processing maliciously crafted web content may disclose sensitive user information
A permissions issue was addressed by removing the vulnerable code. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may disclose sensitive user information.
A flaw was found in WebKitGTK. Processing malicious web content can disclose sensitive user information due to a permissions issue.
Statement: To exploit this vulnerability, an attacker needs to trick a user into processing or loading malicious web content.
Mitigation: Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnom
GHSA
A permissions issue was addressed by removing the vulnerable code.
ghsa_unreviewed·2026-09-14
CVE-2026-64753 [MEDIUM] CWE-269 A permissions issue was addressed by removing the vulnerable code.
A permissions issue was addressed by removing the vulnerable code. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may disclose sensitive user information.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-64753 webkitgtk: Processing maliciously crafted web content may disclose sensitive user information
bugzilla·2026-09-16·CVSS 6.5
CVE-2026-64753 [MEDIUM] CVE-2026-64753 webkitgtk: Processing maliciously crafted web content may disclose sensitive user information
CVE-2026-64753 webkitgtk: Processing maliciously crafted web content may disclose sensitive user information
A permissions issue was addressed by removing the vulnerable code. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may disclose sensitive user information.
Bugzilla
CVE-2026-64753 webkitgtk: Processing maliciously crafted web content may disclose sensitive user information [epel-all]
bugzilla·2026-09-16·CVSS 6.5
CVE-2026-64753 [MEDIUM] CVE-2026-64753 webkitgtk: Processing maliciously crafted web content may disclose sensitive user information [epel-all]
CVE-2026-64753 webkitgtk: Processing maliciously crafted web content may disclose sensitive user information [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A permissions issue was addressed by removing the vulnerable code. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may disclose sensitive user information.
Bugzilla
CVE-2026-64753 webkitgtk: Processing maliciously crafted web content may disclose sensitive user information [fedora-all]
bugzilla·2026-09-16·CVSS 6.5
CVE-2026-64753 [MEDIUM] CVE-2026-64753 webkitgtk: Processing maliciously crafted web content may disclose sensitive user information [fedora-all]
CVE-2026-64753 webkitgtk: Processing maliciously crafted web content may disclose sensitive user information [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A permissions issue was addressed by removing the vulnerable code. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may disclose sensitive user information.
Sans Isc
Apple Updates Everything, (Mon, Sep 14th)
blogs_sans_isc·2026-09-14·CVSS 6.5
CVE-2022-3437 [MEDIUM] Apple Updates Everything, (Mon, Sep 14th)
Apple Updates Everything
Published: 2026-09-14. Last Updated: 2026-09-14 18:33:44 UTC
by Johannes Ullrich (Version: 1)
0 comment(s)
Today, Apple released its annual update across all its operating systems. With that, Apple not only released new features but also patched 261 different vulnerabilities. This is the most vulnerabilities Apple has ever patched, but the increase is not as significant as other vendors' "post-AI" patch releases.
In addition to the major "27" version, Apple also released bug-fix-only releases for the 26 branch of its operating systems and for 15 (Sequioa) for macOS. None of the vulnerabilities is labeled as being exploited. Apple does not note a severity to individual vulnerabilities.
There are some reports about difficulties downloading iOS 27. Users instead
2026-09-14
Published