Apple released Safari 26.4 on March 24, 2026.
The update addresses security vulnerabilities in WebKit for macOS Sonoma and macOS Sequoia.
Vulnerabilities include bypassing Content Security Policy (CSP) and Same Origin Policy (SOP).
Issues also include cross-site scripting (XSS) attacks, process crashes, unauthorized access to script message handlers, and sandbox escapes.
Fixes involve improved state management, input validation, memory handling, and authorization checks.
CVE identifiers include CVE-2026-20665, CVE-2026-20643, CVE-2026-28871, CVE-2026-20664, CVE-2026-28857, CVE-2026-28861, CVE-2026-28859, and CVE-2026-20691.
Researchers credited include webb, Thomas Espach, @hamayanhamayan, Daniel Rhea, Söhnke Benedikt Fischedick, Emrovsky & Switch, Yevhen Pervushyn, Narcis Oliveras Fontàs, Nathaniel Oh, Hongze Wu, Shuaike Dong, greenbynox, Arni Hardarson, and Gongyu Ma.
Additional acknowledgments include @RenwaX23, Bikesh Parajuli, Farras Givari, Syarif Muhammad Sajjad, Yair, Carlos Jeurissen, Rob Wu, Vamshi Paili, and Joseph Semaan.
The update is available via the Mac App Store.
Security content details are posted on Apple’s support page.

Apple has released Safari 26.4, addressing multiple security vulnerabilities in WebKit that affect macOS Sonoma and Sequoia. The update resolves issues such as bypassing Content Security Policy (CSP) and Same Origin Policy (SOP), cross-site scripting (XSS) attacks, unexpected process crashes, unauthorized access to script message handlers, and sandbox escapes. These vulnerabilities could allow malicious websites to execute arbitrary code, access sensitive data, or fingerprint users. The fixes involve improved state management, input validation, memory handling, and authorization checks. Apple acknowledges contributions from multiple security researchers, including those from Ant Group, Tripton, and independent researchers. The update is available via the Mac App Store, with detailed security content listed on Apple’s support page.
The vulnerabilities highlight ongoing challenges in web browser security, particularly in WebKit, which powers Safari and other browsers. While Apple has addressed these issues, the frequency and severity of such vulnerabilities underscore the importance of timely updates and robust security practices for users and developers alike.

The strongest version of this narrative is that Apple is proactively addressing critical security vulnerabilities in Safari, demonstrating a commitment to user safety. The update fixes multiple high-risk issues, including bypasses of fundamental web security mechanisms like CSP and SOP, which could have allowed malicious actors to exploit users. The acknowledgment of numerous external researchers suggests a collaborative approach to security, reinforcing trust in Apple’s processes.
However, the pattern of recurring WebKit vulnerabilities raises questions about the underlying architecture and whether reactive patches are sufficient. The sheer number of CVEs and the diversity of researchers involved hint at a systemic challenge in web browser security. While Apple deserves credit for transparency and timely fixes, the frequency of such updates may normalize a cycle of vulnerability and patching, potentially desensitizing users to the risks.
Root cause: The narrative assumes that software complexity is inevitable and that security is a perpetual arms race rather than a solvable problem. This echoes historical patterns in tech, where convenience and feature expansion often outpace security considerations. The implications for human agency are significant—users are increasingly dependent on vendors to protect them, with little recourse if vulnerabilities are exploited before patches are applied.
Bridge questions: What structural changes in browser design could reduce the frequency of such vulnerabilities? How might users balance convenience with security in an era of constant updates? What incentives could encourage more proactive security measures rather than reactive fixes?
Counterstrike scan: A coordinated influence campaign might exaggerate the severity of these vulnerabilities to undermine trust in Apple or promote alternative browsers. However, the content here is factual and transparent, with no signs of manipulation. The focus on technical details and acknowledgments aligns with standard security disclosure practices, not an attack playbook.
Patterns detected: none