On June 29th, 2026 Apple shipped iOS 26.5.2, iPadOS 26.5.2 and macOS 26.5.2, a trio of point updates that this time did arrive with a properly detailed CVE list. They add up to 37 identifiers across the three platforms, and the breakdown tells a very clear story: the browser is, once again, the way in.
The web engine takes almost all of it
Of the 37 CVEs, 31 belong to WebKit and WebRTC — flaws reachable by doing nothing more than opening a malicious page. WebKit is the engine behind Safari, but also behind every browser and every in-app web view on iOS and iPadOS, so its attack surface is enormous even if you never touch Safari.
The list includes use-after-free bugs, memory corruption and cross-origin logic errors. Translated: anything from crashing your browser to corrupting memory or leaking data from other tabs you had open. Three concrete cases stand out:
- A cross-origin flaw that let a malicious website read data from a different site.
- A bug that allowed a web page to hijack the clipboard silently.
- A sandbox escape that would have let a web process handle restricted content outside the boundaries Safari normally enforces.
Kernel and the rest
Outside the web engine, Apple patched four kernel issues and one in IOGPUFamily, with impacts ranging from an app forcing an unexpected shutdown to writing or leaking kernel memory. Rounding it out are two flaws in libxslt, one in Web Extensions and a handful in WebRTC.
One detail worth keeping in mind: none of the flaws are listed as actively exploited at the time of release. That lowers the urgency compared to the emergency patches Apple ships when an attack is under way. There is an uncomfortable nuance, though: the fixes were already available in the iOS and iPadOS 26.6 betas, so the details had been circulating inside the developer programme for weeks. When that happens, the window between “it is known” and “it is patched everywhere” works against you.
What to do
Update — no mystery here. On iPhone and iPad, go to Settings → General → Software Update. On Mac, System Settings → General → Software Update. If you manage a fleet with MDM, treat it as a minor revision but do not shelve it: 31 web-engine flaws mean it only takes someone opening the wrong link.
The full breakdown is in Apple’s security document for iOS and iPadOS 26.5.2 and on the Apple security releases page. You can also check each platform’s lifecycle on its page: macOS, iOS and iPadOS.