Apple Discloses First Actively Exploited Zero-Day of 2026 — CVE-2026-20700
Apple has released emergency security updates for iOS, iPadOS, and macOS addressing CVE-2026-20700, the first actively exploited zero-day vulnerability of 2026. The flaw exists in WebKit, Apple’s browser rendering engine, and can be triggered by visiting a malicious website.
Vulnerability Details
- CVE: CVE-2026-20700
- CVSS Score: 8.8 (High)
- Component: WebKit (Safari, WKWebView, all iOS browsers)
- Type: Type confusion vulnerability
- Impact: Arbitrary code execution in the browser’s rendering process
- Affected: iOS/iPadOS 17 and 18 before 18.3.2, macOS Sonoma before 14.3.2, Safari before 17.3.1
Why All iOS Browsers Are Affected
Unlike other platforms where Chrome, Firefox, and Edge use their own rendering engines, all browsers on iOS are legally required to use Apple’s WebKit engine. This means Chrome, Firefox, Brave, and every other iOS browser is vulnerable — not just Safari.
How to Update
# iOS/iPadOS
Settings > General > Software Update > Update to 18.3.2
# macOS
System Settings > General > Software Update > Update to 14.3.2
# Verify Safari version
Safari > About Safari
# Should show 17.3.1 or later
# Enterprise MDM (Jamf, Intune)
# Deploy update via MDM policy immediately
# Set "Force Install" for critical security updatesSigns You May Have Been Targeted
- Unexpected app crashes in Safari or other browsers
- Battery draining unusually fast (background processes)
- Unfamiliar apps or profiles appearing in Settings
- Device sending large amounts of data when idle
Checking for Compromise (iOS)
# Use iMazing or similar tool to check for suspicious processes
# Check installed MDM profiles
Settings > General > VPN & Device Management
# Any unknown profiles should be removed immediately
# Use Apple's Stolen Device Protection feature
Settings > Face ID & Passcode > Stolen Device ProtectionThe SudoFlare Takeaway
Update your Apple devices now. Apple rarely confirms active exploitation publicly, so when they do, it means the threat is real and widespread. The zero-click or one-click nature of browser exploits makes them particularly dangerous — you do not need to install anything to be compromised. Enable automatic updates on all Apple devices.
