CVE-2026-20635
📋 TL;DR
This CVE describes a memory handling vulnerability in Apple's WebKit browser engine that affects multiple Apple operating systems and Safari. Processing malicious web content could cause unexpected process crashes, potentially leading to denial of service. All users of affected Apple devices and Safari versions are vulnerable until patched.
💻 Affected Systems
- watchOS
- tvOS
- macOS
- iOS
- iPadOS
- visionOS
- Safari
📦 What is this software?
Ipados by Apple
Ipados by Apple
Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Safari by Apple
Tvos by Apple
Watchos by Apple
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full system compromise if memory corruption can be weaponized beyond crash
Likely Case
Denial of service through browser/application crashes when visiting malicious websites
If Mitigated
Limited to application crashes with proper sandboxing and memory protections
🎯 Exploit Status
Exploitation requires user to visit malicious website or process malicious web content
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: watchOS 26.3, tvOS 26.3, macOS Tahoe 26.3, iOS 18.7.5 and iPadOS 18.7.5, visionOS 26.3, iOS 26.3 and iPadOS 26.3, Safari 26.3
Vendor Advisory: https://support.apple.com/en-us/126346
Restart Required: Yes
Instructions:
1. Open Settings app on Apple device 2. Navigate to General > Software Update 3. Download and install available updates 4. For Safari on macOS, update through System Preferences > Software Update
🔧 Temporary Workarounds
Disable JavaScript
macOSTemporarily disable JavaScript in Safari to prevent malicious web content execution
Safari > Preferences > Security > Uncheck 'Enable JavaScript'
Use alternative browser
allUse non-WebKit based browsers until patches are applied
🧯 If You Can't Patch
- Implement web content filtering to block known malicious sites
- Enable application sandboxing and memory protection features
🔍 How to Verify
Check if Vulnerable:
Check current OS version against affected versions listCheck Version:
macOS: sw_vers -productVersion, iOS/iPadOS: Settings > General > About > Version, Safari: Safari > About SafariVerify Fix Applied:
Verify OS/Safari version matches or exceeds patched versions📡 Detection & Monitoring
Log Indicators:
- Unexpected Safari/WebKit process crashes
- Memory violation errors in system logs
Network Indicators:
- Connections to suspicious domains followed by application crashes
SIEM Query:
source="apple_system_logs" AND (process="Safari" OR process="WebKit") AND event="crash"