Improved State Management Issue in Safari and Apple Products
CVE-2026-20676

4.3MEDIUM

Key Information:

Vendor: Apple
Status: Safari; iOS And iPad OS; Mac OS; Visionos
Vendor: CVE Published:; 11 February 2026

What is CVE-2026-20676?

This state management issue within Safari and Apple’s related software products allows websites to potentially track users through web extensions. The problem has been rectified in versions iOS 26.3, iPadOS 26.3, Safari 26.3, macOS Tahoe 26.3, and visionOS 26.3, enhancing user privacy and security.

Affected Version(s)

iOS and iPadOS 0 < 26.3

macOS 0 < 26.3

Safari 0 < 26.3

References

https://support.apple.com/en-us/126346

https://support.apple.com/en-us/126348

https://support.apple.com/en-us/126353

CVSS V3.1

Score:

4.3

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

None

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Feb 11, 2026
Vulnerability Reserved
Nov 11, 2025

CVE-2026-20676 Data

JSON