Vulnerability Intelligence Report
CVE-2026-112690
This issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. A remote attacker may be able to break out of the WebContent sandbox.
No Active Exploit Signals
CVSS Base Score
9.8
CRITICAL
Exploitability:3.9
Impact Score:5.9
EPSS Probability:0.35%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-22 ↗CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Apple | iOS and iPadOS | 0 < 26.7.2 (affected), 0 < 27.2 (affected) |
| Apple | macOS | 0 < 15.8.2 (affected), 0 < 26.7.2 (affected), 0 < 27.2 (affected) |
| Apple | visionOS | 0 < 27.2 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.352%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Apple Inc. · Vendor · USA |
| Reserved | 2026-10-19T17:05:24 |
| Published | 2026-10-26T20:37:50 |
| Last Updated | 2026-11-03T19:47:04 |
Community Chatter & Buzz