CVE-2026-20652 - Vulnerability Details

- webkitgtk: A remote attacker may be able to cause a denial-of-service

Description

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. A remote attacker may be able to cause a denial-of-service.

Published: 2026-02-11

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a memory handling flaw that can trigger a local crash when a crafted WebKit page is loaded. The flaw is a buffer overflow and a resource exhaustion weakness, meaning a remote attacker can cause the browser to crash or consume excessive resources. As a result, a remote user can cause a denial‑of‑service on the affected device, impacting availability significantly.

Affected Systems

Affected Apple products include Safari, iOS, iPadOS, macOS, and visionOS. Specifically Safari 26.3, iOS 18.7.5 and 26.3, iPadOS 18.7.5 and 26.3, macOS Tahoe 26.3, and visionOS 26.3 are susceptible.

Risk and Exploitability

The CVSS base score of 7.5 indicates a high impact, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely client‑side, requiring an attacker to lure a user into visiting malicious WebKit content. If exploited, the browser or related system component will crash or become unresponsive, leading to service interruption. Given the high severity and potential for service disruption, organizations should prioritize applying the available updates.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apple

Safari

affected

Version	Status	Constraints
`0`	affected	< 26.3

Apple

iOS and iPadOS

affected

Version	Status	Constraints
`0`	affected	< 18.7.5
`0`	affected	< 26.3

Apple

macOS

affected

Version	Status	Constraints
`0`	affected	< 26.3

Apple

visionOS

affected

Version	Status	Constraints
`0`	affected	< 26.3

Configuration 1 [-]

OR	cpe:2.3:a:apple:safari::::::::
	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:visionos::::::::

No data.

Vendor Product Confidence Versions

Apple

Ios And Ipados

—

Version	Status	Scheme	Platform
`[0,26.3)`	affected	generic	—

Apple

Ios And Ipados

—

Version	Status	Scheme	Platform
`[0,18.7)`	affected	generic	—

Apple

Macos

—

Version	Status	Scheme	Platform
`[0,26.3)`	affected	generic	—

Apple

Safari

—

Version	Status	Scheme	Platform
`[0,26.3)`	affected	generic	—

Apple

Visionos

—

Version	Status	Scheme	Platform
`[0,26.3)`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest Apple security updates that patch Safari 26.3, iOS 18.7.5/26.3, iPadOS 18.7.5/26.3, macOS 26.3, and visionOS 26.3 to eliminate the memory handling flaw.
If devices cannot be updated immediately, restrict access to untrusted web content that might trigger the flaw by enabling strict Content Security Policy or disabling WebKit‑based content rendering where possible.
Continuously monitor browser stability logs for unexpected crashes or high memory usage, and apply the patch as soon as it becomes available.

Generated by OpenCVE AI on April 15, 2026 at 20:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4528-1	webkit2gtk security update
Debian DSA	DSA-6172-1	webkit2gtk security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00255.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://nvd.nist.gov/vuln/detail/CVE-2026-20652
https://support.apple.com/en-us/126346
https://support.apple.com/en-us/126347
https://support.apple.com/en-us/126348
https://support.apple.com/en-us/126353
https://support.apple.com/en-us/126354
https://webkitgtk.org/security/WSA-2026-0001.html
https://www.cve.org/CVERecord?id=CVE-2026-20652

History

Thu, 02 Apr 2026 20:30:00 +0000

Type	Values Removed	Values Added
Description	The issue was addressed with improved memory handling. This issue is fixed in macOS Tahoe 26.3, iOS 18.7.5 and iPadOS 18.7.5, visionOS 26.3, iOS 26.3 and iPadOS 26.3, Safari 26.3. A remote attacker may be able to cause a denial-of-service.	The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. A remote attacker may be able to cause a denial-of-service.

Fri, 20 Mar 2026 00:15:00 +0000

Type	Values Removed	Values Added
Title		webkitgtk: A remote attacker may be able to cause a denial-of-service
Weaknesses		CWE-120
References		https://nvd.nist.gov/vuln/detail/CVE-2026-20652 https://webkitgtk.org/security/WSA-2026-0001.html https://www.cve.org/CVERecord?id=CVE-2026-20652
Metrics	threat_severity `None`	threat_severity `Important`

Fri, 13 Feb 2026 15:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apple ipados Apple iphone Os
CPEs		cpe:2.3:a:apple:safari:::::::: cpe:2.3:o:apple:ipados:::::::: cpe:2.3:o:apple:iphone_os:::::::: cpe:2.3:o:apple:macos:::::::: cpe:2.3:o:apple:visionos::::::::
Vendors & Products		Apple ipados Apple iphone Os

Thu, 12 Feb 2026 20:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-400
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 12 Feb 2026 09:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apple Apple ios And Ipados Apple macos Apple safari Apple visionos
Vendors & Products		Apple Apple ios And Ipados Apple macos Apple safari Apple visionos

Wed, 11 Feb 2026 23:15:00 +0000

Type	Values Removed	Values Added
Description		The issue was addressed with improved memory handling. This issue is fixed in macOS Tahoe 26.3, iOS 18.7.5 and iPadOS 18.7.5, visionOS 26.3, iOS 26.3 and iPadOS 26.3, Safari 26.3. A remote attacker may be able to cause a denial-of-service.
References		https://support.apple.com/en-us/126346 https://support.apple.com/en-us/126347 https://support.apple.com/en-us/126348 https://support.apple.com/en-us/126353 https://support.apple.com/en-us/126354

Subscriptions

Apple Ios And Ipados Ipados Iphone Os Macos Safari Visionos

MITRE

Status: PUBLISHED

Assigner: apple

Published: 2026-02-11T22:59:04.639Z

Updated: 2026-04-02T18:26:31.460Z

Reserved: 2025-11-11T14:43:07.864Z

Link: CVE-2026-20652

Vulnrichment

Updated: 2026-02-12T19:30:08.837Z

NVD

Status : Modified

Published: 2026-02-11T23:16:08.033

Modified: 2026-04-02T19:21:17.743

Link: CVE-2026-20652

Redhat

Severity : Important

Publid Date: 2026-03-18T00:00:00Z

Links: CVE-2026-20652 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-15T21:00:09Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object