Apple has released fresh security updates for macOS, iOS and iPadOS to patch dozens of vulnerabilities, most of them in the WebKit browser engine that powers Safari and every browser on iPhone and iPad.[1][6] The new macOS Tahoe 26.6.2, iOS 26.6.1, iPadOS 26.6.1 and iOS/iPadOS 18.7.10 releases collectively address flaws that can be used to crash Safari, corrupt memory, leak sensitive data or escape the browser sandbox when users visit maliciously crafted websites.[1][8][6]
According to reporting by SecurityWeek, macOS Tahoe 26.6.2 ships with fixes for 28 documented security defects, including 21 issues in WebKit that could result in process crashes, memory corruption and exposure of sensitive information.[1] Because WebKit underpins Safari and many macOS applications that embed web views, Macworld notes that nearly all web browsing activity on Macs is exposed to these bugs until the update is installed.[6] Security Boulevard similarly stresses that a large concentration of recent Apple patches have targeted WebKit, underscoring how attractive the browser engine remains to attackers.[12]
On the mobile side, Apple has rolled out iOS 26.6.1 and iPadOS 26.6.1 with patches for the same 28 vulnerabilities affecting macOS, ensuring that the WebKit flaws are addressed across iPhone and iPad as well.[1] These updates also fix an additional Telephony issue that could allow attackers to bypass IPsec authentication, creating a path to intercept network traffic that users expect to be protected by VPN tunnels.[1][8] Security analysts warn that such an authentication bypass could have outsized impact in enterprise environments where mobile devices rely heavily on IPsec-based VPNs for remote access.[1][12]
Apple has also issued iOS 18.7.10 and iPadOS 18.7.10 for older device lines, squashing more than 120 vulnerabilities, including over 40 flaws in WebKit alone.[1] SecurityWeek reports that these legacy-branch updates mirror many of the same browser engine fixes, reducing the risk that attackers will target older iPhones and iPads still in active use but no longer on the main 26.x release track.[1][9] This pattern follows earlier Apple cycles in which large batches of WebKit issues were patched simultaneously across macOS, iOS and iPadOS to keep the browser engine aligned on all platforms.[3][9]
A breakdown published by the SANS Internet Storm Center highlights at least six new WebKit vulnerabilities addressed in the latest round of patches, including CVE-2026-28958 and CVE-2026-28984.[8][14] For CVE-2026-28958, Apple warns that an app may be able to access sensitive user data via a WebKit flaw, while CVE-2026-28984 involves a bug where processing maliciously crafted web content may lead to unexpected Safari crashes.[8][14] These descriptions suggest a mix of information disclosure and stability issues, any of which could be paired with other bugs to achieve more serious outcomes such as code execution or sandbox escape.[1][8]
For defenders, the guidance is straightforward: prioritize deployment of macOS Tahoe 26.6.2, iOS 26.6.1, iPadOS 26.6.1 and iOS/iPadOS 18.7.10 across fleets as soon as operationally feasible, with particular attention to devices that regularly access sensitive web applications or rely on IPsec VPNs.[1][6][12] Organizations should also recognize that WebKit is embedded far beyond Safari itself, including in many third-party apps that render web content, meaning these patches shrink a broad attack surface that has been repeatedly targeted in recent Apple security updates.[3][9][12] Until updates are fully rolled out, security teams may wish to monitor for unusual Safari crashes or signs of browser exploitation, especially on users most exposed to targeted phishing and malicious websites.[1][6][8]
References
- Dozens of WebKit Vulnerabilities Patched With Fresh …
- Apple Patches 19 WebKit Vulnerabilities
- Your iPhone, iPad, and Mac just got an update. Here’s why you should install it ASAP
- Internet Storm Center Diary 2026-08-10 – SANS ISC
- Apple Patches Dozens of Vulnerabilities in macOS, iOS
- Update time: Apple releases security patches for iOS, MacOS Tahoe …
- Apple Patches iOS and macOS – SANS Internet Storm Center
