CVE-2026-86973: 
Apple Safari vulnerability analysis and mitigation

CVE-2026-86973 is an out-of-bounds read vulnerability in Apple's WebRTC component within WebKit, the browser engine underlying Safari, iOS, iPadOS, and macOS. Processing maliciously crafted web content can trigger the flaw, leading to an unexpected process crash. It affects Safari versions prior to 27.2, iOS and iPadOS prior to 26.7.2 and 27.2, and macOS Golden Gate prior to 27.2. The vulnerability was disclosed and patched on October 26, 2026. The CVSS category is estimated as Medium, with an EPSS score of 0.0 at time of publication (Apple Advisory, Github Advisory).

The vulnerability is an out-of-bounds read (CWE-125) in the WebRTC component of WebKit, addressed by Apple through improved bounds checking. An attacker can exploit this by serving maliciously crafted web content — such as a specially constructed webpage — that triggers improper memory access during WebRTC processing. The flaw was credited to Narendra Singh (@_3P1C) and an anonymous researcher, and is tracked under WebKit Bugzilla: 323079. No public proof-of-concept or detailed technical write-up has been published (Apple Advisory, Github Advisory).

Successful exploitation results in an unexpected process crash of the affected browser or web content process, constituting a denial-of-service condition. The primary impact is on availability — an unauthenticated remote attacker can crash Safari or the WebKit-based rendering process by luring a user to a malicious webpage. There is no evidence of confidentiality or integrity impact beyond the process crash, and no lateral movement potential has been identified for this vulnerability (Apple Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Github Advisory, Feedly).

Apple has released patches addressing this vulnerability across all affected platforms. Users should update to Safari 27.2, iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, or iOS/iPadOS 26.7.2 (for the legacy branch). Until patching is complete, limiting exposure to untrusted or unknown web content reduces risk. No configuration-based workaround has been published by Apple (Apple Advisory iOS 26.7.2, Apple Advisory iOS 27.2, Apple Advisory Safari 27.2, Apple Advisory macOS).

The vulnerability was noted in the SANS Internet Storm Center's summary of Apple's October 2026 patch batch, which covered a large number of CVEs across Apple platforms. No significant independent researcher commentary or notable social media discussion specific to CVE-2026-86973 has been identified, consistent with its medium severity and denial-of-service-only impact.