Safari 26.3 Security Update: Apple Patches 6 Critical Vulnerabilities Threatening macOS Users

Quick Brief

• Safari 26.3 patches 6 vulnerabilities including arbitrary file writing and history access flaws
• Update released February 11, 2026 for macOS Sonoma and macOS Sequoia exclusively
• WebKit received 5 separate fixes addressing denial-of-service and process crash risks
• CFNetwork vulnerability (CVE-2026-20660) allowed remote attackers to write arbitrary files

Apple released Safari 26.3 on February 11, 2026, addressing six security vulnerabilities that exposed macOS Sonoma and Sequoia users to privacy breaches and system crashes. The update arrives one day after the release, signaling Apple’s accelerated response to emerging threats. Safari history exposure and arbitrary file writing represented the most severe risks in this patch cycle.

Critical Vulnerabilities Addressed

CFNetwork Arbitrary File Writing Flaw

CVE-2026-20660 enabled remote users to write arbitrary files to affected systems through a path handling defect. Apple resolved this by implementing improved logic in CFNetwork’s file management processes. Security researcher Amy discovered this vulnerability, which carried significant implications for system integrity. The flaw could have allowed attackers to place malicious executables in critical system directories without user interaction.

Safari History Access Vulnerability

A logic issue in Safari (CVE-2026-20656) permitted applications to access users’ browsing history without authorization. Mickey Jin identified this privacy-compromising vulnerability that Apple fixed through improved validation mechanisms. This represents a critical breach of user privacy expectations, as browsing history contains sensitive information about user behavior, financial transactions, and personal research patterns.

WebKit Security Fixes

Denial-of-Service Vulnerabilities

WebKit received five separate patches targeting memory handling and state management issues. CVE-2026-20652, discovered by Nathaniel Oh, addressed a denial-of-service vulnerability triggered by remote attackers. The flaw exploited boundary errors when processing HTML content, causing browser crashes. Similar vulnerabilities (CVE-2026-20635, CVE-2026-20636, CVE-2026-20644) discovered by researchers EntryHi and the TSDubhe team followed identical attack patterns.

Process Crash and Tracking Risks

CVE-2026-20608 enabled maliciously crafted web content to trigger unexpected process crashes through poor state management. Tom Van Goethem identified CVE-2026-20676, which allowed websites to track users through Safari web extensions by exploiting state management weaknesses. Apple addressed both through improved state management protocols.

Affected Systems and Deployment

Safari 26.3 exclusively supports macOS Sonoma and macOS Sequoia. The update does not extend to iOS, iPadOS, or visionOS platforms, which receive security patches through their respective operating system updates. macOS Tahoe 26.3 received a parallel security update on the same date, addressing overlapping vulnerabilities including CVE-2026-20656.

Update Installation Process

macOS users receive Safari 26.3 through System Settings under Software Update. The update installs independently of full system updates, allowing faster deployment of browser security fixes. Apple recommends immediate installation for all macOS Sonoma and Sequoia users to mitigate active exploitation risks.

Context: Recent Safari Security Trends

Safari 26.2, released December 12, 2025, patched two zero-day vulnerabilities (CVE-2025-43529 and CVE-2025-14174) that Apple confirmed were exploited in sophisticated targeted attacks. Google Threat Analysis Group collaborated on discovering these WebKit use-after-free and memory corruption flaws. The rapid succession of critical security updates signals an escalating threat landscape for browser engines in early 2026.

Security Research Recognition

Apple acknowledged contributions from security researchers across multiple organizations. The TSDubhe team and Nan Wang (@eternalsakura13) received recognition for identifying multiple WebKit vulnerabilities. Independent researchers EntryHi, Mickey Jin, and Nathaniel Oh contributed critical vulnerability disclosures. Apple’s security response process includes coordination with researchers like David Wood, Luigino Camastra of Aisle Research, and Vsevolod Kokorin of Solidlab.

Vulnerability Impact Assessment

Apple’s Security Disclosure Policy

Apple maintains a policy of withholding security vulnerability details until investigations conclude and patches deploy. The company references vulnerabilities by CVE identifiers when available and publishes comprehensive documentation on its security releases page. This approach balances transparency with customer protection by preventing exploitation windows between disclosure and patching.

Frequently Asked Questions (FAQs)