iOS 26.6.1 and macOS 26.6.2: Apple Patches Nearly 30 Security Vulnerabilities

Apple released iOS 26.6.1, iPadOS 26.6.1, macOS Tahoe 26.6.2, and visionOS 26.6.1 today, a security-only round of updates that closes out nearly 30 vulnerabilities across its current operating systems. There are no new features here. Apple's release notes are the usual one-liner about security fixes, but the underlying support documents tell a more detailed story: a mix of WebKit memory corruption bugs, a handful of kernel issues, an audio bug that could leak sensitive data, and on iPhone and iPad, a telephony flaw that could let an attacker on the network intercept traffic even through IPSec.

This is Apple's third security release in three weeks, following iOS 26.6 on July 27 and the single-fix macOS Tahoe 26.6.1 on August 7 (that one patched a Screen Sharing authentication bypass, a separate issue from anything addressed today). Apple says the fixes in today's updates were first introduced in the iOS 27, iPadOS 27, and macOS Golden Gate 27 betas and are now being backported to the shipping OS 26 line ahead of the fall release. Apple also shipped iOS 18.7.10 and iPadOS 18.7.10 for iPhones and iPads that can't run iOS 26, carrying many of the same fixes.

Here's what changed, platform by platform.

iOS 26.6.1 and iPadOS 26.6.1 (Build 23G83)

Apple's security document for iOS 26.6.1 and iPadOS 26.6.1 lists 29 CVEs, covering Audio, ImageIO, IOGPUFamily, Kernel, Telephony, and WebKit. Twenty-one of them are WebKit issues, and nine of those were credited to OpenAI Codex Security, part of a broader trend this year of AI-assisted vulnerability discovery showing up across Apple's release notes.

Audio data leak

A logic issue in the audio stack could let an app read sensitive user information it shouldn't have access to. Apple fixed it with improved checks. It's credited to Meta's Red Team X.

ImageIO: denial-of-service and code execution

Two separate ImageIO bugs were patched. One could cause a denial-of-service when processing a malicious image, fixed with improved checks. The other was more serious: an integer overflow that could lead to arbitrary code execution simply from processing a crafted image, closed off with better input validation.

IOGPUFamily memory corruption

Processing maliciously crafted web content could trigger memory corruption in the graphics subsystem. Apple addressed it with improved memory handling.

Kernel: three separate fixes

The kernel picked up three fixes this round. A use-after-free issue could let a remote attacker cause unexpected system termination, patched with better memory management. Two more kernel issues, an out-of-bounds read and a separate memory-handling bug, could let a malicious app crash the system or read and corrupt kernel memory. All three were closed with improved handling of memory and input.

Telephony: IPSec authentication bypass

This is the one unique to iPhone and iPad. An authentication issue in the telephony stack could let an attacker in a privileged network position bypass IPSec authentication and intercept network traffic, even when that traffic was supposed to be encrypted. Apple fixed it with improved state management. It's credited to a team of researchers at Ruhr University Bochum. This is worth taking seriously if you regularly connect to untrusted networks, since it undermines the protection IPSec is specifically there to provide.

WebKit: the bulk of the release

WebKit accounts for 21 of the 29 CVEs patched here, split across the core engine, WebKit History, and WebKit Storage. Most of these are memory corruption, use-after-free, or out-of-bounds access issues that could crash Safari or, in more serious cases, lead to memory corruption when a device processes a malicious web page. One WebKit History bug is worth calling out specifically: visiting a maliciously crafted website could leak sensitive data through Safari's history handling, patched with improved checks. None of the WebKit issues are flagged by Apple as actively exploited in the wild.

Apple also fixed unspecified issues in Compression and libcryptex, acknowledging outside researchers for their assistance without publishing full CVE-level detail on those two.

macOS Tahoe 26.6.2 (Build 25G83)

macOS Tahoe 26.6.2 patches 28 of the same 29 vulnerabilities found in iOS 26.6.1, the entire list minus the iPhone-specific Telephony bug. The category breakdown is identical: Audio, ImageIO, IOGPUFamily, Kernel, and WebKit, with the same underlying descriptions and the same researcher credits.

It's worth being clear about what this update is not: it's not the Screen Sharing fix. That vulnerability, where an attacker on the network could authenticate to Screen Sharing without valid credentials, was patched two weeks ago in macOS Tahoe 26.6.1 (released August 7, credited to Alfredo Pesoli via Bynario Atlas). Today's 26.6.2 is a distinct, unrelated batch of fixes that happens to land right after it. If you're still on 26.6 or earlier, you need both updates to be fully covered.

Given the volume of WebKit fixes here, if you use Safari for anything involving sensitive accounts or you frequently visit unfamiliar sites, this update is worth prioritizing.

visionOS 26.6.1

Apple also released visionOS 26.6.1 today, but as of publishing, Apple hasn't posted the accompanying security content document. Given that Vision Pro shares much of its underlying software with iOS and macOS, it's reasonable to expect substantial overlap with the WebKit and kernel fixes detailed above, but we'll update this article once Apple's documentation for visionOS goes live.

iOS 18.7.10 and iPadOS 18.7.10

If you're on an iPhone or iPad that can't run iOS 26 (iPhone XS/XR and earlier, or comparable iPad hardware), Apple also released iOS 18.7.10 and iPadOS 18.7.10 today with security fixes drawn from the iOS 26.6 cycle. These aren't identical to the iOS 26.6.1 fixes above since they're patching an older codebase, but they cover the same general ground. Update these devices the same way, through Settings.

None of the vulnerabilities in today's release are flagged by Apple as actively exploited. But once a fix ships, the underlying bug becomes public knowledge, and attackers routinely reverse-engineer patches to target devices that haven't updated yet. Given the WebKit-heavy nature of this release, treat it as a real priority rather than something to put off.

To install: open Settings, tap General, then Software Update. On Mac, that's the Apple menu, then System Settings, then General, then Software Update. Full technical detail on every fix, including CVE numbers and researcher credits, is available directly from Apple:

Have you run into any issues installing iOS 26.6.1 or macOS 26.6.2? Let us know in the comments.

Bookmarks

Navigation