Apple has shipped a new batch of security updates for macOS, iOS, and iPadOS, addressing dozens of vulnerabilities concentrated in the WebKit browser engine along with several kernel-level flaws.

macOS Tahoe 26.6.2

The update resolves 28 security defects. Twenty-one of them affect WebKit and could lead to Safari or process crashes, memory corruption, and disclosure of sensitive data. The remaining seven issues span Audio, ImageIO, IOGPUFamily, and Kernel, and could allow sensitive information disclosure, denial-of-service conditions, arbitrary code execution, memory corruption, system termination, or kernel memory disclosure and corruption.

iOS 26.6.1 and iPadOS 26.6.1

These updates carry the same 28 fixes found in the macOS release. Apple also patched an authentication weakness in Telephony that could let an attacker bypass IPSec authentication and intercept network traffic. The releases are expected to precede iOS 27 and iPadOS 27, which are due next month.

iOS 18.7.10 and iPadOS 18.7.10

For devices still on the older platform track, Apple released iOS 18.7.10 and iPadOS 18.7.10, addressing more than 120 vulnerabilities in total, including over 40 in WebKit. Beyond crashes, memory corruption, and data leakage, some of these WebKit issues could enable sandbox escape and cross-origin data exfiltration.

The update also fixes 18 kernel vulnerabilities that could be used to corrupt kernel memory, crash the system, disclose kernel memory, bypass network filters, write to kernel memory, leak sensitive kernel state, or access sensitive user data.

Additional fixes landed in components including:

  • Accessibility, AirDrop, and App Store
  • AVEVideoEncoder, CoreAudio, and CoreMedia
  • Contacts, Foundation, and ImageIO
  • IOSkywalkFamily, Maps, MediaRemote, and Model I/O
  • SceneKit, Siri, and WebRTC

No Known Exploitation

Apple has not indicated that any of these vulnerabilities have been exploited in the wild. Given the volume of WebKit and kernel fixes across both current and legacy platform branches, security teams and end users should apply the updates promptly, especially on devices that browse untrusted web content or handle sensitive data.