Apple
Safari 26.5.2
127685 Jun 29, 2026 Source: Vendor
Imported by the Apple release catcher from https://support.apple.com/en-us/127685. 31 CVE entries, 2 additional recognitions. Available for: macOS Sonoma and macOS Sequoia. Draft. Review before publishing.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://support.apple.com/en-us/127685
Are you credited here?
Sign in and claim your line: it is yours immediately, no review queue.
The name the vendor printed stays next to your handle for anyone to check against the advisory above,
and any member who thinks a claim is wrong can refute it.
Credited
72 lines
Showing 51–72 of 72 · page 2 of 2
CVE-2026-43676
BR2026-0000-006861
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected Safari crash
Credited as dr3dd
CVE-2026-43676
BR2026-0000-006862
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected Safari crash
Credited as Tommy DeVoss from Braze Security Team (@thedawgyg)
CVE-2026-43740
BR2026-0000-006863
WebKit
unclaimed
Processing maliciously crafted web content may result in the disclosure of process memory
Credited as Nathaniel Oh (@calysteon)
CVE-2026-43740
BR2026-0000-006864
WebKit
unclaimed
Processing maliciously crafted web content may result in the disclosure of process memory
Credited as Arni Hardarson
CVE-2026-43713
BR2026-0000-006865
WebKit
unclaimed
Visiting a website may leak sensitive data
Credited as Jody Ritonga
CVE-2026-43708
BR2026-0000-006866
WebKit
unclaimed
A malicious website may exfiltrate data cross-origin
Credited as Behzad Najjarpour Jabbari (@_G4ru_)
CVE-2026-43707
BR2026-0000-006867
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as stratan (@5tratan) of Almamater Technologies
CVE-2026-43707
BR2026-0000-006868
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as OpenAI Codex Security - Amy Burnett
CVE-2026-43705
BR2026-0000-006869
WebKit
unclaimed
Processing maliciously crafted web content may lead to memory corruption
Credited as dr3dd
CVE-2026-43701
BR2026-0000-006870
WebKit
unclaimed
A malicious website may be able to process restricted web content outside the sandbox
Credited as Aaron Grattafiori - NVIDIA AI Red Team
CVE-2026-43745
BR2026-0000-006871
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected Safari crash
Credited as OpenAI Codex Security - Amy Burnett
CVE-2026-43745
BR2026-0000-006872
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected Safari crash
Credited as Khai Tran
CVE-2026-43720
BR2026-0000-006873
WebKit Canvas
unclaimed
Processing maliciously crafted web content may lead to an unexpected Safari crash
Credited as Gia Bui (@yabeow) from Calif.io
CVE-2026-43720
BR2026-0000-006874
WebKit Canvas
unclaimed
Processing maliciously crafted web content may lead to an unexpected Safari crash
Credited as Josef Korbel
CVE-2026-43721
BR2026-0000-006875
WebKit Storage
unclaimed
A malicious website may be able to silently hijack clipboard data
Credited as Idan Masas
CVE-2026-43718
BR2026-0000-006876
WebRTC
unclaimed
Processing maliciously crafted web content may lead to an unexpected Safari crash
Credited as Nan Wang (@eternalsakura13)
CVE-2026-43717
BR2026-0000-006877
WebRTC
unclaimed
Processing maliciously crafted web content may lead to an unexpected Safari crash
Credited as Nan Wang (@eternalsakura13)
CVE-2026-43746
BR2026-0000-006878
WebRTC
unclaimed
Processing maliciously crafted web content may lead to an unexpected Safari crash
Credited as dr3dd
Additional recognition
BR2026-0000-006879
WebKit
unclaimed
Credited as Gurpreet Shergill
Additional recognition
BR2026-0000-006880
WebKit
unclaimed
Credited as Henock Habte
Additional recognition
BR2026-0000-006881
WebKit
unclaimed
Credited as Souta Sugiyama
Additional recognition
BR2026-0000-006882
WebKit JavaScript Bindings
unclaimed
Credited as Karan Kurani