CVE-2026-20665

23

FAUCET Score

CVE-2026-20665 is a medium-severity vulnerability affecting Apple Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS, where processing maliciously crafted web content can bypass Content Security Policy (CSP) enforcement due to an issue with state management. With a CVSS score of 6.5 (Medium), this vulnerability has a network attack vector and low attack complexity, requiring no privileges or user interaction, potentially leading to low confidentiality and availability impacts. There is currently no evidence of active exploitation, public exploit code availability, or significant community discussion or media coverage for this CVE. Apple has addressed this issue through improved state management in Safari 26.4, iOS/iPadOS 18.7.7 and 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, and watchOS 26.4.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		< 26.4CPE matchmatch criteria	cpe:2.3:a:apple:safari::::::::
		< 18.7.7CPE matchmatch criteria	cpe:2.3:o:apple:ipados::::::::
		>= 26.0, < 26.4CPE matchmatch criteria	cpe:2.3:o:apple:ipados::::::::
		< 18.7.7CPE matchmatch criteria	cpe:2.3:o:apple:iphone_os::::::::
		>= 26.0, < 26.4CPE matchmatch criteria	cpe:2.3:o:apple:iphone_os::::::::

CVSS Data

CVSS version used by this source: 3.1

6.5MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

LOW

Exploitability Score

3.9

Impact Score

2.5

CvssVersion

3.1

Exploit Intelligence

EPSS Score

0.61%

Probability of exploitation in next 30 days

EPSS Percentile

45.6%

Percentile rank of EPSS score among Peer Group

As of 2026-07-28

Model: v2026.06.15

This CVE's current EPSS score of 0.0061 is in the 29th percentile among its peer group of 23,725 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (4)

ubuntupatch availablevia ubuntu_usn

Product: webkit2gtk (noble)Fixed in: 2.52.3-0ubuntu0.24.04.1

ubuntupatch availablevia ubuntu_usn

Product: webkit2gtk (questing)Fixed in: 2.52.3-0ubuntu0.25.10.1

ubuntupatch availablevia ubuntu_usn

Product: webkit2gtk (resolute)Fixed in: 2.52.3-0ubuntu0.26.04.2

applevendor investigatingvia apple_support

Vendor Advisories (8)

ubuntuUSN-8237-1

WebKitGTK vulnerabilities

appleapple:126793LOW

About the security content of iOS 18.7.7 and iPadOS 18.7.7 - Apple Support

appleapple:126794LOW

About the security content of macOS Tahoe 26.4 - Apple Support

appleapple:126797LOW

About the security content of tvOS 26.4 - Apple Support

appleapple:126792LOW

About the security content of iOS 26.4 and iPadOS 26.4 - Apple Support

appleapple:126799LOW

About the security content of visionOS 26.4 - Apple Support

appleapple:126800

About the security content of Safari 26.4 - Apple Support

appleapple:126798LOW

About the security content of watchOS 26.4 - Apple Support

References

support.apple.com / en-us/126792

Release NotesVendor Advisory

support.apple.com / en-us/126793

Release NotesVendor Advisory

support.apple.com / en-us/126794

Release NotesVendor Advisory

support.apple.com / en-us/126797

Release NotesVendor Advisory

support.apple.com / en-us/126798

Release NotesVendor Advisory

support.apple.com / en-us/126799

Release NotesVendor Advisory

support.apple.com / en-us/126800

Release NotesVendor Advisory