PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-64778 Apple CVE debrief

Apple has addressed an issue in multiple products, including Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS, which could potentially leak sensitive data when visiting a maliciously crafted website. The issue was fixed in various versions, including Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, and watchOS 27.

Vendor
Apple
Product
Safari
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-17
Original CVE updated
2026-09-14
Advisory published
2026-08-17
Advisory updated
2026-09-14

Who should care

Defenders responsible for Apple product security, particularly those managing Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS deployments, should assess exposure and apply patches to prevent potential data leaks.

Why it matters

Defenders should prioritize verifying and applying patches to mitigate potential data leaks in Apple products. This issue requires attention from those managing Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS deployments.

  • Defenders must verify and apply patches to prevent potential data leaks.
  • Inventory checks are necessary to identify affected products.
  • Monitoring for malicious activity targeting this vulnerability is recommended.

Technical summary

The issue was addressed with improved checks in various Apple products, including Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Visiting a maliciously crafted website may leak sensitive data. The CVSS score is 6.5, and the severity is MEDIUM. Defenders should prioritize verifying and applying patches to mitigate potential data leaks. Affected products require immediate attention to prevent data exposure. Official advisories provide further details on affected versions and patches. Defenders must assess exposure and apply patches.

Defensive priority

Defenders should prioritize verifying and applying the provided patches to mitigate potential data leaks.

Recommended defensive actions

  • Verify and apply patches for Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS.
  • Review and update inventory to ensure affected products are identified and patched.
  • Monitor for potential malicious activity targeting this vulnerability.
  • Perform compensating controls review for exposed systems.
  • Conduct asset inventory checks.
  • Review rollback and change window procedures.
  • Track exceptions and retest remediated assets.

Evidence notes

The CVE record and NVD detail page provide information on the issue, its impact, and affected products. Apple has released advisories and patches for the affected products. Defenders should verify patches for Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Evidence is limited; verify with official advisories. Limited source detail; verify affected scope and vendor guidance.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-64778 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-64778

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-64778 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-64778

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.