CVE-2026-20656: Apple iPadOS

Low severity, CVSS 3.3. EPSS: 0.1% chance of exploitation in the next 30 days.

A logic issue was addressed with improved validation. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, macOS Tahoe 26.3. An app may be able to access a user's Safari history.

Affected products

• Apple iPadOS: before 18.7.5 (fixed in 18.7.5)
• Apple iPhone OS: before 18.7.5 (fixed in 18.7.5)
• Apple macOS: before 26.3 (fixed in 26.3)
• Apple Safari: before 26.3 (fixed in 26.3)

Published 2026-02-11. Last modified 2026-06-17.