CVE-2026-20608

MediumCVSS 5.5

Published: 11/02/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

A vulnerability in WebKit may cause a process crash when processing maliciously crafted web content. The issue was addressed through improved state management.

Risk Assessment

An attacker could trigger a crash in the browser or any WebKit-based application, leading to denial of service (DoS) and potential session data loss.

Recommendation

Immediately update Safari to version 26.3, iOS/iPadOS to 18.7.5 or 26.3, macOS Tahoe to 26.3, and visionOS to 26.3.

Original NVD description (English source)

This issue was addressed through improved state management. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. Processing maliciously crafted web content may lead to an unexpected process crash.