Safari 26.6.1 patches 22 WebKit security flaws reportedly exploitable via malicious web content

Apple’s Safari 26.6.1 update addresses 22 security vulnerabilities in WebKit, the engine powering Safari on macOS Sonoma and Sequoia. All flaws are tied to processing maliciously crafted web content, which could lead to unexpected crashes, memory corruption, or process termination. The update is a routine but critical patch for users and developers who rely on WebKit for rendering web pages or applications.

The vulnerabilities span a range of issues, including memory corruption, use-after-free, and out-of-bounds access. These flaws could be exploited by attackers to execute arbitrary code or disrupt browser functionality. The update mitigates these risks by improving bounds checking, memory handling, and state management in WebKit. No active exploitation is reported, but the nature of the flaws suggests they could be weaponized if left unpatched.

Notably, OpenAI Codex Security is credited with discovering nine of the 22 patched vulnerabilities. This highlights the growing role of AI-assisted tools in identifying security flaws, particularly in complex codebases like WebKit. The collaboration between AI-driven discovery and traditional security research appears to be accelerating the identification of vulnerabilities, though it also raises questions about the scalability of such tools in large-scale projects.

For engineers, the update underscores the importance of keeping WebKit-based browsers patched, especially in environments where Safari is used for testing or deployment. The flaws could impact web applications that rely on WebKit for rendering, making it essential to test against the updated version. The update is available for macOS Sonoma and Sequoia, but no details are provided about its applicability to other platforms or older macOS versions.