widely-deployed-product-advisoryendpoint-software-vulnerabilityinternet-facing-service-vulnerabilityprivacy-surveillance-policy

Apple Fixes Safari WebKit Flaws and Notification Retention Privacy Bug

Patch & Detection Intelligence · 7 sources · Updated 4mo ago · First seen May 13, 2026

Apple released Safari 26.5 for macOS Sonoma and macOS Sequoia to fix multiple vulnerabilities in WebKit and WebRTC that could be triggered by malicious web content. The flaws could allow Content Security Policy bypass, disclosure of sensitive user information, access to sensitive user data, misuse of another website’s download settings through a malicious iframe, and application or process crashes. Apple attributed the issues to validation, access control, UI handling, memory handling, and use-after-free weaknesses, and credited a broad set of external researchers and organizations for the findings.

Apple also shipped updates for older devices—iOS 16.7.16, iPadOS 16.7.16, iPadOS 17.7.11, and iOS/iPadOS 15.8.8—to address CVE-2026-28950 in Notification Services. The bug could cause notifications marked for deletion to remain on a device because of a logging issue, creating a privacy and data-handling risk; Apple said it resolved the problem through improved data redaction. Canada’s Cyber Centre urged users and administrators to review Apple’s advisories and apply the updates, including upgrading Safari systems to 26.5 or later.

Patch this, or something else?See real exploitation activity before you spend the cycle.

Triage this advisory

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

5 events · Apr 22, 2026 – May 13, 2026

May 13, 20266mo ago
Canadian Centre for Cyber Security urges users to apply Safari 26.5 update
On 2026-05-13, the Canadian Centre for Cyber Security issued advisory AV26-466 highlighting Apple's Safari vulnerabilities and recommending that users and administrators update to Safari 26.5 or later. The notice referenced Apple's security information and emphasized prompt patching.
May 13, 20266mo ago
Apple publishes Safari 26.5 security advisory and update
On 2026-05-13, Apple published advisory APPLE-SA-05-13-2026-1 and released Safari 26.5 for macOS Sonoma and macOS Sequoia. The update addressed multiple WebKit and WebRTC vulnerabilities that could enable sensitive data disclosure, Content Security Policy bypass, misuse of download settings, and browser or process crashes.
May 11, 20266mo ago
Apple releases iOS 18.7.9 and iPadOS 18.7.9 security updates
On 2026-05-11, Apple published advisory APPLE-SA-05-11-2026-2 and released iOS 18.7.9 and iPadOS 18.7.9 for supported older devices. The update fixed numerous vulnerabilities across Kernel, WebKit, Wi‑Fi, mDNSResponder, IOKit, and other components, including flaws that could enable root privilege escalation, kernel-level code execution, sensitive data disclosure, denial of service, and security bypasses.
Full Disclosure: APPLE-SA-05-11-2026-2 iOS 18.7.9 and iPadOS 18.7.9
May 11, 20266mo ago
Apple releases fixes for retained deleted notifications across older iOS and iPadOS versions
On 2026-05-11, Apple released iOS 16.7.16, iPadOS 17.7.11, and iOS/iPadOS 15.8.8 to fix CVE-2026-28950, a Notification Services logging issue that could cause notifications marked for deletion to remain on devices. Apple said the issue was mitigated through improved data redaction and made the updates available via Software Update and iTunes.
Apr 22, 20267mo ago
Apple releases iOS 26.4.2 and iPadOS 26.4.2 with notification privacy fix
On 2026-04-22, Apple released iOS 26.4.2 and iPadOS 26.4.2 as bug-fix and security updates. Apple disclosed a fix for a privacy issue where notifications marked for deletion could be unexpectedly retained on the device, and also shipped iOS/iPadOS 18.7.8 with the same fix for older devices.
Apple releases iOS 26.4.2 for iPhone, here’s what’s new - 9to5Mac

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Notification Services notification retention issue in Apple iOS and iPadOS (CVE-2026-28950)

Affected products

2 linked

SafariWebkit

Organizations

1 linked

Apple

Do you run this?See real exploitation activity behind this advisory so you can triage it against everything else in the queue.

Prioritize This Patch

Source coverage

Sources

7 references tracked. Mallory keeps watching after this page renders.

Ca CcsNews · May 13, 2026

Apple security advisory (AV26-466) - Canadian Centre for Cyber SecurityOpen source ↗

Fulldisclosure Mailing ListNews · May 13, 2026

Full Disclosure: APPLE-SA-05-13-2026-1 Safari 26.5Open source ↗

Fulldisclosure Mailing ListNews · May 11, 2026

Full Disclosure: APPLE-SA-05-11-2026-4 iOS 16.7.16 and iPadOS 16.7.16Open source ↗

Fulldisclosure Mailing ListNews · May 11, 2026

Full Disclosure: APPLE-SA-05-11-2026-3 iPadOS 17.7.11Open source ↗

Fulldisclosure Mailing ListNews · May 11, 2026

Full Disclosure: APPLE-SA-05-11-2026-5 iOS 15.8.8 and iPadOS 15.8.8Open source ↗

Fulldisclosure Mailing ListNews · May 11, 2026

Full Disclosure: APPLE-SA-05-11-2026-2 iOS 18.7.9 and iPadOS 18.7.9Open source ↗

9to5macNews · Apr 22, 2026

Apple releases iOS 26.4.2 for iPhone, here’s what’s new - 9to5MacOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

widely-deployed-product-advisoryendpoint-software-vulnerabilityinternet-facing-service-vulnerabilityprivacy-surveillance-policy

Apple Fixes Safari WebKit Flaws and Notification Retention Privacy Bug

Patch & Detection Intelligence · 7 sources · Updated 4mo ago · First seen May 13, 2026

Patch this, or something else?See real exploitation activity before you spend the cycle.

Triage this advisory

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

5 events · Apr 22, 2026 – May 13, 2026

May 13, 20266mo ago
Canadian Centre for Cyber Security urges users to apply Safari 26.5 update
On 2026-05-13, the Canadian Centre for Cyber Security issued advisory AV26-466 highlighting Apple's Safari vulnerabilities and recommending that users and administrators update to Safari 26.5 or later. The notice referenced Apple's security information and emphasized prompt patching.
May 13, 20266mo ago
Apple publishes Safari 26.5 security advisory and update
On 2026-05-13, Apple published advisory APPLE-SA-05-13-2026-1 and released Safari 26.5 for macOS Sonoma and macOS Sequoia. The update addressed multiple WebKit and WebRTC vulnerabilities that could enable sensitive data disclosure, Content Security Policy bypass, misuse of download settings, and browser or process crashes.
May 11, 20266mo ago
Apple releases iOS 18.7.9 and iPadOS 18.7.9 security updates
On 2026-05-11, Apple published advisory APPLE-SA-05-11-2026-2 and released iOS 18.7.9 and iPadOS 18.7.9 for supported older devices. The update fixed numerous vulnerabilities across Kernel, WebKit, Wi‑Fi, mDNSResponder, IOKit, and other components, including flaws that could enable root privilege escalation, kernel-level code execution, sensitive data disclosure, denial of service, and security bypasses.
Full Disclosure: APPLE-SA-05-11-2026-2 iOS 18.7.9 and iPadOS 18.7.9
May 11, 20266mo ago
Apple releases fixes for retained deleted notifications across older iOS and iPadOS versions
On 2026-05-11, Apple released iOS 16.7.16, iPadOS 17.7.11, and iOS/iPadOS 15.8.8 to fix CVE-2026-28950, a Notification Services logging issue that could cause notifications marked for deletion to remain on devices. Apple said the issue was mitigated through improved data redaction and made the updates available via Software Update and iTunes.
Apr 22, 20267mo ago
Apple releases iOS 26.4.2 and iPadOS 26.4.2 with notification privacy fix
On 2026-04-22, Apple released iOS 26.4.2 and iPadOS 26.4.2 as bug-fix and security updates. Apple disclosed a fix for a privacy issue where notifications marked for deletion could be unexpectedly retained on the device, and also shipped iOS/iPadOS 18.7.8 with the same fix for older devices.
Apple releases iOS 26.4.2 for iPhone, here’s what’s new - 9to5Mac

Linked entities