CVE-2026-84635
published 2026-09-14CVE-2026-84635: A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27…
PriorityP334medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.37%
29.8th percentile
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to an unexpected process termination.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios_and_ipados | < 27 | 27 |
| apple | ipados | < 27.0 | 27.0 |
| apple | iphone_os | < 27.0 | 27.0 |
| apple | macos | < 27 | 27 |
| apple | macos | < 27.0 | 27.0 |
| apple | safari | < 27 | 27 |
| apple | safari | < 27.0 | 27.0 |
| apple | tvos | < 27 | 27 |
| apple | tvos | < 27.0 | 27.0 |
| apple | visionos | < 27 | 27 |
| apple | visionos | < 27.0 | 27.0 |
| apple | watchos | < 27 | 27 |
| apple | watchos | < 27.0 | 27.0 |
| webkitgtk | webkitgtk | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apple iOS/iPadOS/macOS/Safari/tvOS/visionOS/watchOS up to 26 denial of service
vuldb·2026-09-15
CVE-2026-84635 [LOW] Apple iOS/iPadOS/macOS/Safari/tvOS/visionOS/watchOS up to 26 denial of service
A vulnerability, which was classified as problematic, was found in Apple iOS, iPadOS, macOS, Safari, tvOS, visionOS and watchOS up to 26. Affected by this vulnerability is an unknown functionality. The manipulation results in denial of service.
This vulnerability is identified as CVE-2026-84635. The attack can be executed remotely. There is not any exploit available.
You should upgrade the affected component.
GHSA
A logic issue was addressed with improved state management.
ghsa_unreviewed·2026-09-14
CVE-2026-84635 A logic issue was addressed with improved state management.
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to an unexpected process termination.
Red Hat
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination
vendor_redhat·2026-09-14·CVSS 6.5
CVE-2026-84635 [MEDIUM] CWE-664 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to an unexpected process termination.
A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process termination due to improper state management.
Statement: To exploit this vulnerability, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.
Additionally, this issue can cause an unexpected process termination but the possibility of re
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-84635 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination [epel-all]
bugzilla·2026-09-16·CVSS 6.5
CVE-2026-84635 [MEDIUM] CVE-2026-84635 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination [epel-all]
CVE-2026-84635 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to an unexpected process termination.
Bugzilla
CVE-2026-84635 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination [fedora-all]
bugzilla·2026-09-16·CVSS 6.5
CVE-2026-84635 [MEDIUM] CVE-2026-84635 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination [fedora-all]
CVE-2026-84635 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to an unexpected process termination.
Bugzilla
CVE-2026-84635 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination
bugzilla·2026-09-16·CVSS 6.5
CVE-2026-84635 [MEDIUM] CVE-2026-84635 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination
CVE-2026-84635 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to an unexpected process termination.
Sans Isc
Apple Updates Everything, (Mon, Sep 14th)
blogs_sans_isc·2026-09-14·CVSS 6.5
CVE-2022-3437 [MEDIUM] Apple Updates Everything, (Mon, Sep 14th)
Apple Updates Everything
Published: 2026-09-14. Last Updated: 2026-09-14 18:33:44 UTC
by Johannes Ullrich (Version: 1)
0 comment(s)
Today, Apple released its annual update across all its operating systems. With that, Apple not only released new features but also patched 261 different vulnerabilities. This is the most vulnerabilities Apple has ever patched, but the increase is not as significant as other vendors' "post-AI" patch releases.
In addition to the major "27" version, Apple also released bug-fix-only releases for the 26 branch of its operating systems and for 15 (Sequioa) for macOS. None of the vulnerabilities is labeled as being exploited. Apple does not note a severity to individual vulnerabilities.
There are some reports about difficulties downloading iOS 27. Users instead
2026-09-14
Published