Raw JSON
{
"containers": {
"cna": {
"affected": [
{
"product": "Safari",
"vendor": "Apple",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-02-11-2026-9 Safari 26.3\n\nSafari 26.3 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/126354.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nCFNetwork\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: A remote user may be able to write arbitrary files\nDescription: A path handling issue was addressed with improved logic.\nCVE-2026-20660: Amy (amys.website)\n\nSafari\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: An app may be able to access a user's Safari history\nDescription: A logic issue was addressed with improved validation.\nCVE-2026-20656: Mickey Jin (@patch1t)\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: A remote attacker may be able to cause a denial-of-service\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 303959\nCVE-2026-20652: Nathaniel Oh (@calysteon)\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: This issue was addressed through improved state management.\nWebKit Bugzilla: 303357\nCVE-2026-20608: HanQing from TSDubhe and Nan Wang (@eternalsakura13)\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: A website may be able to track users through Safari web\nextensions\nDescription: This issue was addressed through improved state management.\nWebKit Bugzilla: 305020\nCVE-2026-20676: Tom Van Goethem\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 303444\nCVE-2026-20644: HanQing from TSDubhe and Nan Wang (@eternalsakura13)\nWebKit Bugzilla: 304657\nCVE-2026-20636: EntryHi\nWebKit Bugzilla: 304661\nCVE-2026-20635: EntryHi\n\nAdditional recognition\n\nWebKit\nWe would like to acknowledge David Wood, EntryHi, Luigino Camastra of\nAisle Research, Stanislav Fort of Aisle Research, Vsevolod Kokorin\n(Slonser) of Solidlab and Jorian Woltjer for their assistance.\n\nSafari 26.3 may be obtained from the Mac App Store.\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple's Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmmND7oACgkQ4Ifiq8DH\n7PVR4Q//dqRTn1jkGTKX6nBZPJSyVizdP9clKnd6CSvTUrYbTzw0/53Kw17n6etD\nMV/KVu4NyuZIV/qPdGcjqAgNAnG4VVWsLOyMKIgE2ccTXf/DWsWAnsKqc+S1HUk3\nNHmwu+OHbsgQ+8yWOOEYg6nsZEXR/1WTLEqCJCJOAVNF+ORCcx0fLik+KUkw//+W\nK60gCR/RnxtFnI8GJvvgOe8Vz1ddkMb8TXQfvkjg/mB+C6r/Z35g5EqWZIMhO09H\nkQ6KX/CEr3FDqvh5bVC7kyzDc2WFtrU+syynpLmvb2NLeaeOr4ZW0OX+CpTGXm2O\nWjWxZTSvWJBJkGp8SzE6PimRkFirj9VdHcQk16XV/zGnnBx2dd9R2dVeuWxpjNO5\nsfKCkwW1Xr7b0pnMEsG6NB+SQL3GTm9FD8zcFjh62zZig9+BB59KyMNwkXTtSrwB\nmjBU9ORc3tfwcH8Vdk/2vQFvyio//eP3CwDDkDo1ujI1srjWaojrneBWApLwtbIp\nZ8ojnNVIzHt0o2ViuxXQ+uH82s0RrJBTSYgss/pGB113aAKMoqBexfqqkFwPq1JU\nmHgEXjgQPNGTgocUBYsDO2C4+zrExK+oiBL5sjaQDIS6tyydPLtoRQa8QAq7KQ/B\nnS69vbgZ81xhxqj0PpoBnCII65Hg3STeLTF08fcvG5VmdhWD0kQ=\n=Z1wf\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:11:52Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/29"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Feb/29"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/126354"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Feb/29"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-02-11-2026-9 Safari 26.3",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-20608",
"type": "related"
},
{
"destId": "CVE-2026-20635",
"type": "related"
},
{
"destId": "CVE-2026-20636",
"type": "related"
},
{
"destId": "CVE-2026-20644",
"type": "related"
},
{
"destId": "CVE-2026-20652",
"type": "related"
},
{
"destId": "CVE-2026-20656",
"type": "related"
},
{
"destId": "CVE-2026-20660",
"type": "related"
},
{
"destId": "CVE-2026-20676",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0224",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/29",
"automated": true,
"contentSha256": "9aea801414c7be6df33a563b5359c4c074aeac99c47a9b003c0538fbc1a41a29",
"evidenceScore": 6,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/29",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-02-12T00:06:52Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T07:57:43Z",
"dateUpdated": "2026-09-11T11:11:52Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0224"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}