CVE-2026-113952: 
Apple Safari vulnerability analysis and mitigation

CVE-2026-113952 is a security feature bypass vulnerability in Apple's WebKit engine that allows a website to use a media format that should be restricted when Lockdown Mode is enabled. The flaw stems from a logic issue in media format handling and was addressed with improved checks. It affects Safari versions prior to 27.2, iOS and iPadOS prior to 26.7.2 and 27.2, and macOS Golden Gate prior to 27.2. The vulnerability was disclosed and patched on October 26, 2026. The CVSS category is estimated as HIGH, with an EPSS score of 0.0 (Apple Advisory, Feedly).

The vulnerability is a logic issue (no CWE formally assigned) within the WebKit browser engine's media format handling subsystem, specifically tracked under WebKit Bugzilla #324004. When Lockdown Mode is active on Apple devices, certain media formats are supposed to be blocked to reduce the attack surface for high-risk users; however, insufficient logic checks allowed a malicious website to bypass this restriction and load otherwise-blocked media content. The vulnerability was discovered by Drinor Selmanaj of Sentry and requires only that a user visit a malicious website using an affected browser — no additional user interaction or authentication is needed (Apple Advisory, Github Advisory).

Successful exploitation allows an unauthenticated remote attacker to circumvent Apple's Lockdown Mode media format restrictions by directing a targeted user to a malicious website. This undermines a key security control designed to protect high-risk individuals (such as journalists, activists, and executives) from sophisticated attacks, potentially exposing them to media-based exploitation vectors that Lockdown Mode was specifically designed to block. While the direct impact is a security feature bypass rather than immediate code execution or data exfiltration, it could serve as a precondition for chaining with other vulnerabilities (Apple Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The vulnerability is exploitable by any unauthenticated remote attacker who can direct a Lockdown Mode user to a malicious website, requiring no special privileges or user interaction beyond visiting the page. The EPSS score is 0.0, indicating a currently low probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly, Github Advisory).

1. Identify targets: Determine targets who use Apple devices with Lockdown Mode enabled — typically high-risk individuals such as journalists, activists, or executives using Safari, iOS, or iPadOS prior to the patched versions.
2. Craft malicious webpage: Create a webpage that embeds or references a media format (e.g., a specific audio or video codec) that is normally blocked by Lockdown Mode's media restrictions in WebKit.
3. Deliver the link: Lure the target into visiting the malicious webpage via phishing, social engineering, or a watering hole attack.
4. Trigger the bypass: When the target's unpatched WebKit processes the page, the logic flaw causes the restricted media format to be loaded and processed despite Lockdown Mode being active, bypassing the intended security restriction.
5. Chain with further exploitation: Use the bypassed media format as a stepping stone to deliver additional payloads or exploit other WebKit vulnerabilities that Lockdown Mode would otherwise have blocked (Apple Advisory).

Apple has released patches addressing this vulnerability in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, and macOS Golden Gate 27.2, all released on October 26, 2026. Users should update their Apple devices to these versions immediately via Settings > General > Software Update (iOS/iPadOS) or System Settings > Software Update (macOS). As an interim measure, users relying on Lockdown Mode for protection should avoid visiting untrusted websites until the patch is applied (Apple Advisory, Apple iOS 26.7.2, Apple macOS).

The SANS Internet Storm Center noted this vulnerability as part of their coverage of Apple's October 2026 patch batch (SANS ISC). The vulnerability was credited to Drinor Selmanaj of Sentry, a well-known application monitoring company, indicating active security research engagement from the broader developer tooling community. No significant public controversy or widespread social media discussion has been observed beyond standard patch notification coverage.