EUVD-2026-65740

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.5 and iPadOS 26.5. A malicious app may be able to enumerate installed apps...

CVE-2026-43657

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.5 and iPadOS 26.5. A malicious app may be able to enumerate installed apps...

CVE-2026-43670

A Content Security Policy bypass was addressed with improved enforcement in AudioWorklet contexts. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5. Processing maliciously crafted web content may bypass Content Security Policy...

CVE-2026-43670

A Content Security Policy bypass was addressed with improved enforcement in AudioWorklet contexts. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5. Processing maliciously crafted web content may bypass Content Security Policy...

EUVD-2026-65739

A Content Security Policy bypass was addressed with improved enforcement in AudioWorklet contexts. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5. Processing maliciously crafted web content may bypass Content Security Policy...

CVE-2026-43670

A Content Security Policy (CSP) bypass exists in the WebKit engine due to insufficient enforcement in AudioWorklet contexts . Processing maliciously crafted web content can allow an attacker to bypass CSP protections. This vulnerability affects macOS Sonoma and macOS Sequoia (via Safari, iOS, and...

GO-2026-6268 Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs in github.com/fleetdm/fleet

Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs in github.com/fleetdm/fleet...

PT-2026-82023

Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs in github.com/fleetdm/fleet...

CVE-2026-64705: Buffer Copy without Checking Size of Input

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.6. An app may be able to cause unexpected system termination or write kernel memory...

PT-2026-81777

Name of the Vulnerable Software and Affected Versions Google Chrome on iOS versions prior to 152.0.7977.65 Description Incorrect authorization in the mobile version of the browser allows a remote attacker to bypass system access restrictions by using a crafted HTML page. Recommendations Update to...

PT-2026-81588

Name of the Vulnerable Software and Affected Versions Google Chrome on iOS versions prior to 152.0.7977.65 Description An information leak exists that allows a local attacker to potentially obtain sensitive information through a local program. Recommendations Update Google Chrome on iOS to versio...

CVE-2026-78935: Use of Uninitialized Variable

Use of uninitialized variable in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

PT-2026-81494

Name of the Vulnerable Software and Affected Versions iOS versions prior to 18.7.9 iOS versions prior to 26.5 iPadOS versions prior to 18.7.9 iPadOS versions prior to 26.5 Description A null pointer dereference occurs due to insufficient input validation, which may allow an application to cause...

PT-2026-81490

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.5 iPadOS versions prior to 26.5 Description A permissions issue exists where a malicious application may be able to enumerate installed apps on the device. Recommendations Update iOS to version 26.5. Update iPadOS to...

CVE-2026-43657: Improper Privilege Management

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.5 and iPadOS 26.5. A malicious app may be able to enumerate installed apps...

CVE-2026-65367: NULL Pointer Dereference

A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5. An app may be able to cause unexpected system termination...

CVE-2026-78964: Use After Free

Use after free in Sync in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Low...

CVE-2026-79207: Exposure of Sensitive Information to an Unauthorized Actor

Information leak in Passwords in Google Chrome on on iOS prior to 152.0.7977.65 allowed a local attacker to obtain sensitive information via a crafted file. Chromium security severity: Low...

CVE-2026-78957: Exposure of Sensitive Information to an Unauthorized Actor

Information leak in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a local attacker to obtain sensitive information via a crafted file. Chromium security severity: Low...

CVE-2026-43670: Protection Mechanism Failure

A Content Security Policy bypass was addressed with improved enforcement in AudioWorklet contexts. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5. Processing maliciously crafted web content may bypass Content Security Policy...