Loading vulnerability…
Use-after-free in WebKit JavaScriptCore WebAssembly memory handling
CVE-2026-20664 is a memory-handling vulnerability in WebKit that can cause an unexpected process crash when processing maliciously crafted web content. The technical analysis identifies a stale-pointer flaw in JavaScriptCore's refresh logic for non-shared, resizable WebAssembly memory. When WebAssembly.Memory grows in BoundsChecking mode, its underlying memory allocation can be replaced while the associated buffer's m_data pointer remains directed at the freed allocation. This leaves a typed-array view capable of accessing freed Primitive Gigacage memory. In a demonstrated Safari exploit chain, a separate Fetch response-cloning behavior places opaque cross-origin response data into allocations accessible through the stale view, enabling a Same-Origin Policy bypass and sensitive-data disclosure. Affected products include Safari and Apple operating systems incorporating vulnerable WebKit, as well as WebKitGTK and WPE WebKit before 2.52.1.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Malicious web content can cause an unexpected WebKit process crash, disrupting affected browsing or embedded web-content functionality. In the demonstrated Safari chain, combining the stale WebAssembly memory view with Fetch response-cloning behavior enables disclosure of authenticated cross-origin response data, including access tokens that can support account takeover. The memory flaw alone was described as confined to the Primitive Gigacage; the cross-origin disclosure requires the additional Fetch behavior. The demonstrated chain did not provide remote code execution or a sandbox escape.
If you can’t patch tonight, do this now.
Apply the vendor-provided updates. Until updates are deployed, reduce exposure to untrusted web content and restrict use of affected browsers for authenticated sessions where feasible.
Patch, then assume compromise.
Update to Safari 26.4, iOS 26.4, iPadOS 26.4, macOS Tahoe 26.4, or visionOS 26.4, as applicable, or a later supported release incorporating the fix. The identified fixed builds include iOS and iPadOS 23E6254 and macOS Tahoe 25E253 or later. Safari 26.4 supplies the fix for macOS Sonoma and macOS Sequoia. Update WebKitGTK and WPE WebKit to version 2.52.1 or later, or install distribution-provided packages containing the backported fix. The vulnerability was addressed through improved memory handling.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.