vulnerability
Apple patches 24+ WebKit bugs that were visible for weeks
2026-06-30
Apple has rolled out a sizeable round of security updates across iOS, iPadOS, macOS Tahoe and Safari, fixing more than two dozen vulnerabilities in one go. The bulk of them sit inside WebKit, the browser engine that powers Safari and, on iPhone and iPad, every other browser you might have installed. Chrome, Firefox, Edge: they all run on WebKit underneath when they're on an Apple mobile device. A WebKit bug is everyone's bug.
The bugs had a head start
The more interesting detail is how the fixes were tested. Apple ran them against the iOS 26.6 and iPadOS 26.6 betas, which are public. That means the underlying vulnerabilities have effectively been visible for weeks. Researchers, and anyone less friendly who pays attention to beta release notes, have had time to read, poke and start sketching out exploits.
None of the issues are confirmed as exploited in the wild yet. But the gap between disclosure and patch is the part attackers love, and on this round, that gap has been generous.
What's actually been patched
The list is a familiar mix of browser-engine problems:
- Use-after-free bugs, where the browser keeps using a chunk of memory after it has been freed, a classic route to code execution.
- Memory corruption issues that can let a crafted page misbehave in interesting ways.
- Cross-origin logic errors, the kind of bug that lets one site quietly read from another it shouldn't be touching.
- Permission handling slips in Web Extensions, which broadens the blast radius beyond plain web pages.
Apple notes that several of these can be chained together. Loading a dodgy page could crash the browser, leak data from another tab, or run code with very little user involvement. There are also fixes in libxslt (XML transformations) and WebRTC (real-time browser communication), two libraries that often slip out of people's mental model of "the browser" but are very much part of the attack surface.
What to do
On iPhone or iPad, open Settings, then General, then Software Update, and let it pull the latest version down. On a Mac, Software Update will install the matching Safari fix at the same time as the macOS update. If you've turned automatic updates off at some point and forgotten about it, this is a reasonable week to switch them back on.
The thing worth sitting with isn't the patch itself, it's the pattern. Public beta testing is great for stability and rough for secrecy. When the same code that ships to millions of devices is the code being used to validate the fix, the window between "researchers can see this" and "users are protected" matters more than ever. On this round, that window was measured in weeks.