CVE-2026-20656
📋 TL;DR
A logic vulnerability in Apple's iOS, iPadOS, Safari, and macOS allows malicious applications to access a user's Safari browsing history without proper authorization. This affects users running outdated versions of these Apple products. The issue has been addressed through improved validation in the latest updates.
💻 Affected Systems
- iOS
- iPadOS
- Safari
- macOS
📦 What is this software?
Ipados by Apple
Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Safari by Apple
⚠️ Risk & Real-World Impact
Worst Case
Malicious app exfiltrates complete Safari browsing history, potentially revealing sensitive personal information, financial data, or private communications.
Likely Case
Malicious app accesses limited browsing history data, potentially compromising user privacy and exposing browsing habits.
If Mitigated
With proper app sandboxing and user permissions, impact is limited to apps the user has already granted excessive permissions to.
🎯 Exploit Status
Requires user to install a malicious application. No public exploit code is known at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: iOS 18.7.5, iPadOS 18.7.5, Safari 26.3, macOS Tahoe 26.3
Vendor Advisory: https://support.apple.com/en-us/126347
Restart Required: No
Instructions:
1. Open Settings app. 2. Go to General > Software Update. 3. Install available updates. 4. For macOS, go to System Settings > General > Software Update. 5. For Safari, update through App Store or system updates.
🔧 Temporary Workarounds
Restrict App Installation Sources
allOnly install apps from official App Store to reduce risk of malicious apps.
Review App Permissions
allRegularly review and restrict app permissions in system settings.
🧯 If You Can't Patch
- Implement mobile device management (MDM) to control app installation
- Use application allowlisting to restrict which apps can run
🔍 How to Verify
Check if Vulnerable:
Check current version against affected versions: iOS/iPadOS < 18.7.5, Safari < 26.3, macOS < Tahoe 26.3Check Version:
iOS/iPadOS: Settings > General > About > Version. macOS: Apple menu > About This Mac > macOS version. Safari: Safari menu > About SafariVerify Fix Applied:
Verify version is equal to or greater than: iOS/iPadOS 18.7.5, Safari 26.3, macOS Tahoe 26.3📡 Detection & Monitoring
Log Indicators:
- Unusual Safari process access by third-party apps
- App requesting excessive file system permissions
Network Indicators:
- Unexpected data exfiltration from Safari data directories
SIEM Query:
process_name:safari AND file_access:*history* AND NOT user:current_user