Apple has published a full list of security fixes for Safari 26.5, including a WebKit vulnerability that could allow maliciously crafted web content to expose sensitive user information. Here are the details.
On that day, the company released the full security content of each update, and you can find more details about it here.
Now, Apple has released security content for Safari 26.5, which includes fixes for 20 WebKit vulnerabilities, as well as a WebRTC issue that can cause unexpected process crashes.
WebKit
Available for: macOS Sonoma and macOS Sequoia
Impact: Malformed web content processing may prevent the Content Security Policy from being applied
Description: The authentication problem has been addressed with an improved logic.
WebKit Bugzilla: 308906
CVE-2026-43660: Cantina
WebKit
Available for: macOS Sonoma and macOS Sequoia
Impact: Malformed web content processing may prevent the Content Security Policy from being applied
Description: An issue was addressed with improved input validation.
WebKit Bugzilla: 308675
CVE-2026-28907: Cantina
WebKit
Available for: macOS Sonoma and macOS Sequoia
Impact: Processing poorly crafted web content may expose sensitive user information
Description: This issue was addressed with improved access restrictions.
WebKit Bugzilla: 309698
CVE-2026-28962: Luke Francis, Vaagn Vardanian, kwak kiyong / kakaogames, Vitaly Simonovich, Adel Bouachraoui, greenbynox
WebKit
Available for: macOS Sonoma and macOS Sequoia
Impact: Processing poorly designed web content may lead to unexpected Safari crashes
Description: The problem was addressed with improved memory management.
WebKit Bugzilla: 307669
CVE-2026-43658: Do Young Park
WebKit
Available for: macOS Sonoma and macOS Sequoia
Impact: Processing poorly designed web content may lead to unexpected process crashes
Description: The problem was addressed with improved memory management.
WebKit Bugzilla: 308545
CVE-2026-28905: Yuhao Hu, Yuanming Lai, Chenggang Wu, and Zhe Wang
WebKit Bugzilla: 308707
CVE-2026-28847: DARKNAVY (@DarkNavyOrg), Anonymous working with TrendaI Zero Day Initiative, Daniel Rhea
WebKit Bugzilla: 309601
CVE-2026-28904: Luka Rački
WebKit Bugzilla: 310880
CVE-2026-28955: wac and Kookhwan Lee work with TrendAI Zero Day Initiative
WebKit Bugzilla: 310303
CVE-2026-28903: Mateusz Krzywicki (Verify.io)
WebKit Bugzilla: 309628
CVE-2026-28953: Maher Azzouzi
WebKit Bugzilla: 309861
CVE-2026-28902: Tristan Madani (@TristanInSec) from Talence Security, Nathaniel Oh (@calysteon)
WebKit Bugzilla: 310207
CVE-2026-28901: Aisle security research team (Joshua Rogers, Luigino Camastra, Igor Morgenstern, and Guido Vranken), Maher Azzouzi, Ngan Nguyen of Calif.io
WebKit Bugzilla: 311631
CVE-2026-28913: unknown researcher
WebKit
Available for: macOS Sonoma and macOS Sequoia
Impact: Processing poorly designed web content may lead to unexpected process crashes
Description: An issue with running after free was addressed with improved memory management.
WebKit Bugzilla: 313939
CVE-2026-28883: kwak kiyong / kakaogames
WebKit
Available for: macOS Sonoma and macOS Sequoia
Impact: The application may have access to sensitive user data
Description: This issue was addressed with improved data protection.
WebKit Bugzilla: 311228
CVE-2026-28958: Cantina
WebKit
Available for: macOS Sonoma and macOS Sequoia
Impact: Processing poorly designed web content may lead to unexpected process crashes
Description: An issue was addressed with improved input validation.
WebKit Bugzilla: 310527
CVE-2026-28917: Vitaly Simonovich
WebKit
Available for: macOS Sonoma and macOS Sequoia
Impact: Processing poorly designed web content may lead to unexpected Safari crashes
Description: An issue with running after free was addressed with improved memory management.
WebKit Bugzilla: 310234
CVE-2026-28947: dr3dd
WebKit Bugzilla: 310544
CVE-2026-28946: Gia Bui (@yabeow) from Calif.io, dr3dd, w0wbox
WebKit Bugzilla: 312180
CVE-2026-28942: Milad Nasr and Nicholas Carlini and Claude, Anthropic
WebKit
Available for: macOS Sonoma and macOS Sequoia
Impact: A malicious iframe may use the download settings of another website
Description: The issue was addressed with improved UI management.
CVE-2026-28971: Khiem Tran
WebKit Bugzilla: 311288
WebRTC
Available for: macOS Sonoma and macOS Sequoia
Impact: Processing poorly designed web content may lead to unexpected process crashes
Description: The problem was addressed with improved memory management.
WebKit Bugzilla: 311131
CVE-2026-28944: Kenneth Hsu of Palo Alto Networks, Jérôme DJOUDER, dr3dd
If your Mac is compatible with Safari 26.5, it would be a good idea to make sure you’re running the latest version as soon as possible.