CVE-2026-64713 | This issue was addressed with improved checks. This issue is… | CVSS 8.1 HIGH

Description

This issue was addressed with improved checks. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Websites may know if the user has visited a given link.

Metadata

CVE ID: CVE-2026-64713
State: PUBLISHED
Assigner: apple
Reserved: 2026-07-20 18:09 UTC
Published: 2026-07-27 20:13 UTC
Last updated: 2026-07-28 19:11 UTC
Primary CWE: CWE-203
CWE-203 Observable Discrepancy
Vendor / Product: Apple / Safari
Sources: cve.org · NVD

Severity & Metrics

8.1 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: total

Affected products (6)

Vendor	Product	Platform	Versions
Apple	iOS and iPadOS	—	0 < 26.6
Apple	macOS	—	0 < 26.6
Apple	Safari	—	0 < 26.6
Apple	tvOS	—	0 < 26.6
Apple	visionOS	—	0 < 26.6
Apple	watchOS	—	0 < 26.6

Weakness (CWE)

CWE	Source	Description
—	cna	Websites may know if the user has visited a given link
CWE-203	adp	CWE-203 Observable Discrepancy

CVSS scores (1)

Score	Severity	Version	Source	Vector
8.1	HIGH	3.1	adp	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References (6)