CVE-2026-86922
published 2026-10-20CVE-2026-86922: A type confusion issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27…
PriorityP354high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.25%
15.8th percentile
A type confusion issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Processing maliciously crafted web content may lead to arbitrary code execution.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios_and_ipados | < 27 | 27 |
| apple | macos | < 27 | 27 |
| apple | safari | < 27 | 27 |
| apple | visionos | < 27 | 27 |
| webkitgtk | webkitgtk | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A type confusion issue was addressed with improved state management.
ghsa_unreviewed·2026-10-20
CVE-2026-86922 [HIGH] CWE-843 A type confusion issue was addressed with improved state management.
A type confusion issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Processing maliciously crafted web content may lead to arbitrary code execution.
Red Hat
webkitgtk: WebKitGTK: Arbitrary code execution via type confusion
vendor_redhat·2026-10-20·CVSS 8.8
CVE-2026-86922 [HIGH] CWE-843 webkitgtk: WebKitGTK: Arbitrary code execution via type confusion
webkitgtk: WebKitGTK: Arbitrary code execution via type confusion
A flaw was found in WebKitGTK. Due to a type confusion issue—where the application misinterprets an object's data type in memory—processing maliciously crafted web content can lead to memory corruption. A remote attacker could exploit this vulnerability to achieve arbitrary code execution on the targeted system.
Mitigation: --- CME Mitigation Guidance (2026-10-20) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value act
No detection rules found.
No public exploits indexed.
2026-10-20
Published