Apple's security updates for iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, and Safari 26.5.2 fix a total of 37 vulnerabilities across multiple components including WebKit (26 bugs), kernel, WebRTC, Web Extensions, and others. The WebKit vulnerabilities include issues in Canvas and Storage that could be exploited via malicious websites to exfiltrate data, leak sensitive information, crash Safari, corrupt memory, disclose process memory, hijack clipboard data, and process restricted content outside the sandbox. Other flaws affect kernel memory writes, kernel state disclosure, and system crashes. At least four vulnerabilities were identified with AI assistance and reported by Anthropic and OpenAI Codex researchers. The Safari update patches 31 vulnerabilities affecting Web Extensions, WebKit, and WebRTC on macOS Sonoma and Sequoia. Apple has not reported any active exploitation but historically such bugs have been weaponized shortly after disclosure. Users are encouraged to update devices promptly to mitigate these risks.

The vulnerabilities could allow attackers to exfiltrate sensitive data, cause application and system crashes, corrupt memory, disclose kernel and process memory, hijack clipboard data, and bypass sandbox restrictions. These impacts affect iPhone, iPad, Mac, and Safari users. While no active exploitation has been reported, the nature of the bugs—especially those in WebKit triggered by malicious websites—poses a significant risk if unpatched.

Apple has released official security updates (iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, Safari 26.5.2) that address these vulnerabilities. Users should apply these updates as soon as possible to mitigate the risks. There is no indication that additional mitigation steps are required beyond updating to the patched versions.