CVE-2026-64730: 
Apple Safari vulnerability analysis and mitigation

CVE-2026-64730 is a UI spoofing vulnerability in Apple's WebKit engine affecting Safari and all major Apple platforms. The flaw allows a malicious website that frames content to spoof browser UI elements, potentially deceiving users about the origin or legitimacy of the content they are viewing. It was disclosed and patched on July 27, 2026, affecting all versions of Safari, iOS/iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS prior to the 26.6 release. The vulnerability was discovered by Kagami Rosylight of Mozilla and is tracked under WebKit Bugzilla #311660. The CVSS category is estimated as Medium (Apple Advisory, Feedly).

The vulnerability resides in WebKit's handling of framed web content, where insufficient UI rendering controls allow a malicious page to present spoofed interface elements to the user (CWE-451: User Interface (UI) Misrepresentation of Critical Information). The attack vector is network-based and requires no authentication — a user simply needs to visit a crafted website that embeds or frames malicious content. Apple's fix involved "improved UI" handling within WebKit to prevent framed content from influencing or mimicking trusted browser UI elements. No specific technical write-up or public proof-of-concept code has been identified beyond Apple's advisory (Apple Advisory - watchOS, Apple Advisory - tvOS).

Successful exploitation allows an unauthenticated remote attacker to deceive users into believing they are interacting with a trusted website or legitimate UI element, when in fact they are viewing attacker-controlled content. This can facilitate phishing attacks, credential harvesting, or social engineering by making malicious content appear to originate from a trusted source. The vulnerability affects a broad range of Apple devices across Safari, iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS, amplifying the potential user population at risk (Apple Advisory - iOS/iPadOS, Apple Advisory - macOS).

1. Craft a malicious website: The attacker creates a webpage that uses HTML iframes or similar framing techniques to embed content designed to mimic trusted browser UI elements (e.g., address bar, security indicators, or dialog boxes).
2. Lure the victim: The attacker distributes a link to the malicious page via phishing email, social media, or malicious advertisement targeting users on unpatched Apple devices.
3. Trigger UI spoofing: When the victim visits the page using a vulnerable version of Safari or a WebKit-based browser, the framed malicious content renders spoofed UI elements that appear to belong to a trusted site or the browser itself.
4. Achieve objective: The victim, deceived by the spoofed UI, may enter credentials, approve permissions, or take other actions believing they are interacting with a legitimate interface — enabling credential theft or further social engineering (Apple Advisory - tvOS, Apple Advisory - visionOS).

Apple has released patches addressing this vulnerability across all affected platforms. Users should update to the following versions or later: Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. No configuration-based workaround is available; upgrading to the patched release is the only recommended remediation. Users should apply updates promptly via System Settings > General > Software Update on their respective devices (Apple Advisory - iOS/iPadOS, Apple Advisory - macOS, Apple Advisory - visionOS).

The vulnerability was reported by Kagami Rosylight of Mozilla, reflecting cross-organization collaboration in browser security research. Apple followed its standard policy of not disclosing details until patches were available, releasing fixes simultaneously across all affected platforms on July 27, 2026. No significant public commentary or media coverage beyond the vendor advisories has been identified at this time (Apple Advisory - watchOS, Apple Advisory - tvOS).