Skip to content
Fencer Vulns
high 8.8

CVE-2026-86922 json

A type confusion issue was addressed with improved state management.

published 2026-10-20 20 d ago modified 2026-11-09 3 h ago also EUVD-2026-104721

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 27%
public exploits
0
none known

Summary

A type confusion issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Processing maliciously crafted web content may lead to arbitrary code execution.

Patch / fix

  • Apple Safari 27
  • Apple iOS and iPadOS 27
  • Apple macOS 27
  • Apple visionOS 27

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-86922 updated cvss 8.8

webkitgtk: WebKitGTK: Arbitrary code execution via type confusion

  • Red Hat Enterprise Linux 7 webkitgtk3, webkitgtk4, libwebkit2gtk, webkitgtk4-jsc, webkitgtk4-plugin-process-gtk2
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Enterprise Linux 6 webkitgtk
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
20 d ago

Exploit prediction

0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

  • Apple Safari
  • Apple iOS and iPadOS
  • Apple macOS
  • Apple visionOS

Classification

Weakness
  • CWE-843 Access of Resource Using Incompatible Type

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.