CVE-2026-113897: Sandbox escape on macOS, iOS and visionOS

Critical CVSS 10.0: Web Content sandbox escape. Patches in macOS 27.2, iOS 27.2, visionOS 27.2.

CVE-2026-113897 is a Web Content sandbox escape flaw affecting Safari, iOS, iPadOS, macOS Golden Gate and visionOS. A remote attacker can craft a webpage to break out of the browser sandbox and gain elevated privileges. Apple addressed the vulnerability by removing the vulnerable code. The flaw has a CVSS score of 10.0, the maximum on the scale, classified as critical.

The flaw was acknowledged and publicly disclosed on 2026-10-26. Patches are available immediately for all affected platforms. Social media signals are limited (1 post in the last 24 hours, 4 total interactions), but the content discussed is consistent: it confirms CVSS 10.0 and lists the same patched versions. No public exploit is reported on GitHub repositories, which provides a temporal advantage for defenders. However, the simplicity of the sandbox escape vulnerability and its high visibility warrant caution in the patch cycle.

Immediate action: inventory all Safari, iOS, iPadOS and visionOS installations in your environments. Plan rollout of the following updates as soon as possible: Safari 27.2, iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. In environments with patch cycle constraints, prioritize devices and systems with access to sensitive data or critical functions. Do not download or test exploits from unofficial sources: the risk of exposure before patching outweighs the informational gain.

At a glance

What: Web Content sandbox escape: remote attacker can break out of web content sandbox via a crafted webpage. The vulnerability has been fixed by removing vulnerable code.
Severity: Critical - CVSS 10.0 (maximum). Impact: code execution with privileges beyond the Web Content sandbox.
Affected versions: Affected: Safari before 27.2, iOS and iPadOS before 27.2, macOS Golden Gate before 27.2, visionOS before 27.2. Unverified signals suggest Tahoe 26.7.2 and Sequoia 15.8.2 are also patched.
Fix: Update to Safari 27.2, iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2 or later. No fixes reported for older versions.
Status: Vulnerability acknowledged by Apple on 2026-10-26, patches available. Public discussion on social channels with low activity (1 post in 24 hours, consistent with NVD data).
Action: 1) Verify Safari, iOS/iPadOS and visionOS versions in your environments. 2) Plan updates to patched versions as soon as possible. 3) Test in non-production environment before rollout. No public exploits reported.

Sources: NVD, CVE-2026-113897

← All articles