Executive brief
A security vulnerability in Apple's web browser engine could allow malicious websites to bypass Content Security Policy (CSP) protections. CSP is a critical security layer that helps prevent various types of attacks, such as data theft and unauthorized site modifications. If exploited, an attacker could potentially execute unauthorized actions or access data on websites that the user visits.
Technical details
A logic vulnerability exists in the validation component of Apple's web content processing engine. The flaw allows maliciously crafted web content to circumvent Content Security Policy (CSP) directives, which are intended to restrict the resources (such as JavaScript, CSS, Images) that a browser is allowed to load for a given page. An attacker can exploit this by hosting a malicious website or injecting content into a vulnerable site, leading to the bypass of security headers designed to prevent Cross-Site Scripting (XSS) and data exfiltration. The issue was addressed with improved validation logic in Safari 26.5 and corresponding OS updates.
Affected products
- Apple Safari Before 26.5
- Apple iOS Before 18.7.9 and 26.5
- Apple iPadOS Before 18.7.9 and 26.5
- Apple macOS Tahoe Before 26.5
- Apple tvOS Before 26.5
- Apple visionOS Before 26.5
- Apple watchOS Before 26.5
Timeline
- 2026-05-11: disclosed
- 2026-05-11: patched
- 2026-05-11: advisory