CVE-2026-112690: Apple WebContent Sandbox Escape

CVE-2026-112690 is a critical vulnerability allowing a remote attacker to break out of the WebContent sandbox in Apple operating systems (iOS, iPadOS, macOS, visionOS). The sandbox is the isolation mechanism that protects the rest of the system from potentially hostile web code. A remote attacker could bypass this control and access privileged resources. The vulnerability was discovered and reported to Apple, which confirmed the issue and released patches.

Severity is maximum: CVSS 10.0, critical category. Apple confirmed the fix on October 26, 2026, available in iOS 26.7.2 and 27.2, iPadOS 26.7.2 and 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Social media discussion (posts from 2026-11-04) confirms severity and version numbers. No public exploit is reported in public databases, but online visibility indicates the issue is now widely known.

Administrators and CISOs must prioritize immediate update of all Apple devices in inventory to patched versions. Verify the list of devices not yet updated and plan rapid rollout. For devices that cannot be updated immediately, implement network controls limiting access to WebContent from untrusted sources. Carefully monitor browser behavior and sandbox alerts until all updates are completed.