AppleAnalysisApple addresses WebKit use-after-free memory corruption flaw across operating system platforms
What happened.Apple published a coordinated security update resolving a high-severity use-after-free memory corruption vulnerability discovered within the WebKit browser engine across operating system runtimes.
Why it matters.Rendering engines run behind consumer browsers, internal web views, and mobile application wrappers. When memory corruption vulnerabilities affect core browser components, user interaction with unvetted links can compromise client devices. Systems engineers managing enterprise fleets should enforce automated patch updates across mobile devices and workstations. Mobile application developers should verify that embedded web view components inherit current system WebKit runtime libraries.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-112637, improper memory handling in WebKit canvas and JavaScript bindings allows malicious web content to induce memory corruption.
- Exploitation impact: Threat actors can exploit the defect by inducing browser sessions to process crafted web pages, triggering arbitrary code execution inside application sandboxes.
- Platform coverage: Apple deployed patched memory management routines across iOS 27.2, iPadOS 27.2, macOS Tahoe, tvOS 27.2, watchOS 27.2, visionOS 27.2, and Safari 27.2.