CVE-2026-84635

webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination

Published Sep 14, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to an unexpected process termination.

Analysis

Technical impact

A logic flaw in Apple’s state‑management system can be triggered by maliciously crafted web content, causing the affected process or application to terminate abruptly. The impact is a denial‑of‑service condition, as normal user activity may be interrupted and the user may need to restart the application or device.

Affected Systems

Apple Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS in any release prior to build 27.x. The patch was introduced in Safari 27, iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27.

Risk and Exploitability

Exploitation requires delivery of tailored web content to a user’s device, typically by visiting a malicious website. The CVSS score of 6.5 indicates moderate risk from a severity point of view, while the EPSS score of < 1% indicates a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. With no known active exploitation, the overall risk is considered moderate, but the denial‑of‑service impact satisfies a DoS classification because it can disrupt user experience or system stability.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apple

Safari

affected

Version	Status	Constraints
`0`	affected	< 27

Apple

iOS and iPadOS

affected

Version	Status	Constraints
`0`	affected	< 27

Apple

macOS

affected

Version	Status	Constraints
`0`	affected	< 27

Apple

tvOS

affected

Version	Status	Constraints
`0`	affected	< 27

Apple

visionOS

affected

Version	Status	Constraints
`0`	affected	< 27

Apple

watchOS

affected

Version	Status	Constraints
`0`	affected	< 27

Configuration 1 [-]

OR	cpe:2.3:a:apple:safari::::::::
	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:tvos::::::::
	cpe:2.3:o:apple:visionos::::::::
	cpe:2.3:o:apple:watchos::::::::

No data.

Vendor Product Versions

Apple

Ios And Ipados

Version	Status	Scheme	Platform
`[0,27)`	affected	generic	—

Apple

Macos

Version	Status	Scheme	Platform
`[0,27)`	affected	generic	—

Apple

Safari

Version	Status	Scheme	Platform
`[0,27)`	affected	generic	—

Apple

Tvos

Version	Status	Scheme	Platform
`[0,27)`	affected	generic	—

Apple

Visionos

Version	Status	Scheme	Platform
`[0,27)`	affected	generic	—

Apple

Watchos

Version	Status	Scheme	Platform
`[0,27)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update to Safari 27 or newer and to iOS 27, iPadOS 27, macOS 27, tvOS 27, visionOS 27, and watchOS 27 or later so the state‑management fix is in place.
Disable or restrict JavaScript execution in the affected browsers to reduce the likelihood of triggering the flaw.
Implement network or content filtering to block or monitor known malicious domains that could deliver the crafted web content.

Generated by OpenCVE AI on September 20, 2026 at 20:42 UTC.

Tracking

Advisories

Source	ID	Title
Debian DSA	DSA-6534-1	webkit2gtk security update

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.371% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://nvd.nist.gov/vuln/detail/CVE-2026-84635
https://support.apple.com/en-us/149034
https://support.apple.com/en-us/149035
https://support.apple.com/en-us/149036
https://support.apple.com/en-us/149037
https://support.apple.com/en-us/149038
https://support.apple.com/en-us/149039
https://www.cve.org/CVERecord?id=CVE-2026-84635

History

Sep 18, 2026 1:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apple ipados Apple iphone Os
CPEs		cpe:2.3:a:apple:safari:::::::: cpe:2.3:o:apple:ipados:::::::: cpe:2.3:o:apple:iphone_os:::::::: cpe:2.3:o:apple:macos:::::::: cpe:2.3:o:apple:tvos:::::::: cpe:2.3:o:apple:visionos:::::::: cpe:2.3:o:apple:watchos::::::::
Vendors & Products		Apple ipados Apple iphone Os

Sep 17, 2026 12:15 PM Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title		webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination
Weaknesses		CWE-664
References		https://nvd.nist.gov/vuln/detail/CVE-2026-84635 https://www.cve.org/CVERecord?id=CVE-2026-84635
Metrics	threat_severity `None`	threat_severity `Important`

Sep 16, 2026 8:30 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-843
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 16, 2026 12:45 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title	State Management Logic Flaw Causes Unexpected Process Termination in Apple Browsers and OS
Weaknesses	CWE-20 CWE-707

Sep 15, 2026 11:30 AM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title		State Management Logic Flaw Causes Unexpected Process Termination in Apple Browsers and OS
Weaknesses		CWE-20 CWE-707

Sep 15, 2026 7:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apple Apple ios And Ipados Apple macos Apple safari Apple tvos Apple visionos Apple watchos
Vendors & Products		Apple Apple ios And Ipados Apple macos Apple safari Apple tvos Apple visionos Apple watchos

Sep 14, 2026 9:00 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description		A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to an unexpected process termination.
References		https://support.apple.com/en-us/149034 https://support.apple.com/en-us/149035 https://support.apple.com/en-us/149036 https://support.apple.com/en-us/149037 https://support.apple.com/en-us/149038 https://support.apple.com/en-us/149039