Safari UAF in JavaScriptCore: Apple Patches Already Available

CVE-2026-64715 in Safari's JavaScript engine enables remote code execution simply by visiting a malicious page. Patches were released on August 24.

On August 24, 2026, Trend Micro's Zero Day Initiative published advisory ZDI-26-610 detailing a use-after-free vulnerability in the JavaScriptCore engine powering Apple Safari. The flaw, tracked as CVE-2026-64715 with a ZDI-rated CVSS score of 8.8, allows remote code execution in the browser's renderer process when a user visits a malicious web page or opens a compromised file. Apple released patches the same day as the coordinated disclosure.

Key Takeaways

The vulnerability resides in the B3 ReduceStrength phase of JavaScriptCore's JIT compiler, where the existence of an object is not validated before operations are performed on it
Exploitation requires minimal user interaction: visiting a malicious page or opening a compromised file is sufficient to trigger code execution in the renderer process
The remediation cycle lasted approximately 39 days, from private reporting on July 16, 2026, to coordinated publication on August 24, 2026
Patched versions include Safari 26.6.1, iOS and iPadOS 18.7.10/26.6.1, and macOS Tahoe 26.6.2, per the official CVE Record

The Flaw at the Heart of Apple's JIT Compiler

The specific defect lies in the ReduceStrength phase of JavaScriptCore's B3 (Bare Bones Backend) pipeline. As documented in advisory ZDI-26-610, the issue stems from a failure to validate an object's existence before the compiler performs operations on it. This use-after-free condition translates into attacker-controllable memory corruption.

The B3 compiler serves as one of Apple's JIT backends for optimized JavaScript execution. The ReduceStrength phase simplifies arithmetic and logical operations during intermediate code optimization. The inherent complexity of these transformations, combined with manual memory management in specific engine areas, creates an attack surface that researchers continue to find fertile.

"The specific flaw exists within the B3 ReduceStrength phase. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the renderer process." — ZDI Advisory ZDI-26-610

From Memory Corruption to Code Execution in the Renderer

The stated impact is remote arbitrary code execution in the context of Safari's renderer process. According to the ZDI advisory, "User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file." This phrasing indicates a drive-by-download or malicious document attack, requiring no authentication or prior privileges.

The renderer process operates within a sandbox on modern Apple systems, which bounds the immediate blast radius of the exploit. The dossier does not document sandbox escape techniques or local escalation mechanisms: the confirmed impact stops at execution within the isolated rendering engine context. This still represents a significant risk for session data theft, DOM manipulation, and potential chaining with other vulnerabilities.

Timeline and Attribution of the Discovery

The vulnerability was discovered by Hossein Lotfi, operating under the handle @hosselot and affiliated with Trend Micro's Zero Day Initiative. Private disclosure to Apple occurred on July 16, 2026. Coordinated publication followed on August 24, 2026, after a remediation cycle of approximately 39 days.

Apple confirmed the nature of the flaw in its own security advisory with the standard formulation: "A use-after-free issue was addressed with improved memory management." The vendor explicitly credits Hossein Lotfi of Trend Micro Zero Day Initiative for CVE-2026-64715. The convergence between the independent source (ZDI) and the vendor (Apple) on mechanism, CVE identifier, and attribution makes the documentary record particularly solid.

What to Do Now

Update Safari to version 26.6.1 or later on macOS, and verify iOS/iPadOS are on version 18.7.10, 26.6.1, or later, per the applicable release branch
On macOS Tahoe, apply update 26.6.2, which includes the fix for CVE-2026-64715
Verify in system settings that automatic security updates are enabled to shrink the exposure window for future rendering engine vulnerabilities
Limit browsing to untrusted sites until the update is complete, since the exploit triggers on simply visiting a malicious page

Why the ReduceStrength Phase Remains a Minefield

Lotfi's discovery fits an established pattern: JIT optimizations, while critical for modern browser performance, accumulate complexity that evades static verification. The ReduceStrength phase manipulates algebraic expressions and pointer operations in a context where garbage collection and manual allocation coexist. When an object is freed but a reference persists in the optimization graph, the compiler generates code that operates on reallocated memory: the attacker controls the content and hijacks execution.

The case also documents the effectiveness of the coordinated disclosure model through specialized programs like ZDI. The roughly 39 days between reporting and patching reflect a balance between pressure for timeliness and the complexity of fixing a widely deployed JavaScript engine. The absence of reported in-the-wild exploitation prior to the fix, while not documented in the dossier as a certainty, suggests the cycle contained the risk before public disclosure.

For Apple users, the episode reinforces a constant: the rendering engine is the most exposed perimeter of the operating system, and every security update for Safari or iOS should be applied with the same priority as kernel patches.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references