This issue was addressed through improved state management. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

Vendors Products
Apple
  • Ios And Ipados
  • Ipados
  • Iphone Os
  • Macos
  • Safari
  • Tvos
  • Visionos
  • Watchos

Configuration 1 [-]

OR cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*

No data.

References
Link Providers
https://support.apple.com/en-us/126792 cve-icon cve-icon
https://support.apple.com/en-us/126793 cve-icon cve-icon
https://support.apple.com/en-us/126794 cve-icon cve-icon
https://support.apple.com/en-us/126797 cve-icon cve-icon
https://support.apple.com/en-us/126798 cve-icon cve-icon
https://support.apple.com/en-us/126799 cve-icon cve-icon
https://support.apple.com/en-us/126800 cve-icon cve-icon
History

Thu, 26 Mar 2026 12:30:00 +0000

Type Values Removed Values Added
Title CSP Bypass via Malicious Web Content in Apple Browsers
Weaknesses CWE-79

Wed, 25 Mar 2026 22:00:00 +0000

Type Values Removed Values Added
Title CSP Bypass via Malicious Web Content in Apple Browsers
First Time appeared Apple ipados
Apple iphone Os
Weaknesses CWE-79
CPEs cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
Vendors & Products Apple ipados
Apple iphone Os

Wed, 25 Mar 2026 20:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-693
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 25 Mar 2026 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios And Ipados
Apple macos
Apple safari
Apple tvos
Apple visionos
Apple watchos
Vendors & Products Apple
Apple ios And Ipados
Apple macos
Apple safari
Apple tvos
Apple visionos
Apple watchos

Wed, 25 Mar 2026 01:00:00 +0000

Type Values Removed Values Added
Description This issue was addressed through improved state management. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.
References
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published: 2026-03-25T00:32:50.032Z

Updated: 2026-03-25T19:31:29.619Z

Reserved: 2025-11-11T14:43:07.866Z

Link: CVE-2026-20665

cve-icon Vulnrichment

Updated: 2026-03-25T19:30:59.579Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-25T01:17:05.050

Modified: 2026-03-25T21:54:07.070

Link: CVE-2026-20665

cve-icon Redhat

No data.