CVE-2026-64728: 
Apple Safari vulnerability analysis and mitigation

CVE-2026-64728 is a permissions issue in Apple's WebKit engine that allows maliciously crafted web content to violate iframe sandboxing policy. The vulnerability was disclosed on July 27, 2026, as part of Apple's coordinated security update across its entire product ecosystem. Affected products include Safari (before 26.6), iOS and iPadOS (before 26.6), macOS Tahoe (before 26.6), tvOS (before 26.6), visionOS (before 26.6), and watchOS (before 26.6). The vulnerability was reported by an anonymous researcher and is tracked under WebKit Bugzilla #313220. No official CVSS score has been published; Feedly estimates the severity as Medium with an EPSS score of 0.0 (Apple iOS/iPadOS Advisory, Apple watchOS Advisory, Apple tvOS Advisory).

The root cause is a permissions issue (CWE-732: Incorrect Permission Assignment for Critical Resource) in WebKit's handling of iframe sandbox policy validation. Specifically, the flaw resides in WebKit's sandbox enforcement logic (WebKit Bugzilla #313220), where insufficient validation of permissions allows crafted web content to escape the restrictions imposed by the HTML sandbox attribute on iframes. An attacker can exploit this by serving a malicious web page that embeds a sandboxed iframe with crafted content designed to bypass the sandbox restrictions — no user interaction beyond visiting the page is required. Apple addressed the issue with improved validation of permissions in the WebKit engine (Apple iOS/iPadOS Advisory, Apple tvOS Advisory, Apple visionOS Advisory).

Successful exploitation allows an attacker to bypass iframe sandboxing protections in WebKit, which are designed to isolate untrusted or third-party web content from the host page and broader system. This sandbox bypass could enable cross-origin data access, script execution outside the intended sandbox context, or interaction with privileged page content that the sandboxed iframe should not be able to reach. The impact primarily affects confidentiality and integrity of web browsing sessions across all Apple platforms running a vulnerable WebKit version, including iPhone, iPad, Mac, Apple TV, Apple Watch, and Apple Vision Pro (Apple iOS/iPadOS Advisory, Apple watchOS Advisory).

1. Reconnaissance: Identify target users running unpatched Apple devices (Safari < 26.6, iOS/iPadOS < 26.6, macOS Tahoe < 26.6, tvOS < 26.6, visionOS < 26.6, or watchOS < 26.6) that use WebKit-based browsers.
2. Craft malicious web page: Create a web page that embeds a sandboxed iframe using the HTML sandbox attribute, with crafted content designed to exploit the permissions validation flaw in WebKit (WebKit Bugzilla #313220).
3. Host and deliver: Host the malicious page on an attacker-controlled server and lure the target into visiting it via phishing, malvertising, or a compromised website.
4. Trigger sandbox bypass: When the victim's WebKit-based browser renders the page, the maliciously crafted iframe content exploits the permissions issue to violate the sandbox policy, potentially enabling cross-origin script execution or data access that the sandbox was intended to prevent.
5. Achieve objective: Leverage the sandbox bypass to exfiltrate sensitive data from the parent page context, perform unauthorized actions, or chain with other vulnerabilities for further impact (Apple iOS/iPadOS Advisory, Apple tvOS Advisory).

Apple has released patches addressing this vulnerability across all affected platforms. Users should update to the following versions or later: Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6 — all released July 27, 2026. Updates can be applied via System Settings (macOS) or Settings > General > Software Update (iOS/iPadOS/watchOS/tvOS/visionOS). No configuration-based workaround is available; upgrading to a patched version is the only recommended remediation (Apple iOS/iPadOS Advisory, Apple macOS Advisory, Apple watchOS Advisory).