CVE-2026-84518: 
Apple Safari vulnerability analysis and mitigation

CVE-2026-84518 is an information disclosure vulnerability in Apple Safari, iOS, and iPadOS that allows a malicious website to determine what applications a user has installed on their device. The flaw stems from inadequate state management in the browser/OS layer and was discovered by Bálint Magyar (balintmagyar.com). It was disclosed and patched on September 14, 2026, affecting Safari versions prior to 27, iOS and iPadOS prior to 27, and macOS prior to Golden Gate 27. It carries a CVSS v3.1 base score of 4.3 (Medium) (Apple Advisory Safari, Apple Advisory iOS/iPadOS).

The root cause is classified as CWE-642 (External Control of Critical State Data), where browser state is not properly isolated or managed, allowing a malicious website to probe and infer which applications are installed on the user's device. The attack vector is network-based and requires user interaction — specifically, a user must visit a malicious website — but requires no authentication or special privileges from the attacker. The mechanism likely involves timing side-channels or URL scheme handling behaviors that leak app-presence information through observable state differences in Safari's handling of custom URL schemes or similar APIs. No public proof-of-concept code has been identified (Apple Advisory Safari, Feedly).

Successful exploitation results in a limited confidentiality breach: an unauthenticated remote attacker can enumerate which applications are installed on a victim's device by luring them to a malicious website. This information can be used for targeted social engineering, fingerprinting, or profiling users based on their installed software (e.g., banking apps, VPN clients, or security tools). There is no integrity or availability impact, and the vulnerability does not enable code execution or direct data theft (Apple Advisory iOS/iPadOS, Apple Advisory macOS).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The EPSS score is 0.0, indicating very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is not automatable and requires user interaction (visiting a malicious website), limiting its practical attack surface (Feedly).

Apple has released patches addressing this vulnerability in Safari 27, iOS 27, iPadOS 27, and macOS Golden Gate 27, all released on September 14, 2026. Users should update their devices to these versions immediately via Software Update. As a precautionary measure, users should avoid visiting untrusted or suspicious websites until their devices are patched. No configuration-based workaround has been published by Apple (Apple Advisory Safari, Apple Advisory iOS/iPadOS, Apple Advisory macOS).

The SANS Internet Storm Center noted the September 14, 2026 Apple security update release in a diary entry covering the broad patch release (SANS ISC). Coverage also appeared on 9to5Mac, which summarized the security fixes included in iOS 27 and iPadOS 27. No significant independent researcher commentary or social media discussion specific to CVE-2026-84518 has been identified, consistent with its medium severity and lack of active exploitation.