On June 29, 2026, Apple issued security updates for iOS/iPadOS 26.5.2, macOS Tahoe 26.5.2, and Safari 26.5.2. The updates address multiple vulnerabilities primarily in WebKit, libxslt, WebRTC, and Web Extensions, which could lead to unexpected process crashes, memory corruption, sensitive data disclosure, cross-origin data exfiltration, and sandbox escape. Additionally, three kernel vulnerabilities and one in the IOGPUFamily were fixed, involving potential system termination, kernel memory corruption, and sensitive kernel state leakage. None of the vulnerabilities are reported as exploited in the wild. No updates were released for visionOS, watchOS, or tvOS, which is unusual given Apple's typical simultaneous update approach across platforms.

The vulnerabilities could allow attackers to cause denial of service via crashes, corrupt memory, disclose sensitive user or process information, exfiltrate data across origins, and bypass sandbox restrictions in web content processing. Kernel vulnerabilities could lead to unexpected system termination or kernel memory corruption, potentially impacting system stability and security. The IOGPUFamily issue may also cause unexpected system termination. No active exploitation has been observed, reducing immediate risk but warranting timely patching.

Apple has released official security updates for iOS/iPadOS 26.5.2, macOS Tahoe 26.5.2, and Safari 26.5.2 that address these vulnerabilities. Users and administrators should apply these updates promptly to mitigate the risks. No updates are currently available for visionOS, watchOS, or tvOS. There are no known exploits in the wild, and the vendor has not indicated any additional mitigation steps beyond applying the patches.