Apple rolls out WebKit security fixes: macOS, iPhone and iPad updates

Apple has shipped macOS Tahoe 26.6.2, along with iOS and iPadOS 26.6.1. The updates bring a sizable set of security patches for Macs, iPhones, and iPads, and most of them touch WebKit, the browser engine behind Safari.

For supported current devices, Apple lists 28 fixes. On the Mac side, 21 of those are tied to WebKit. iPhone and iPad users get those same 28 fixes, plus one more for Telephony authentication. Since every browser on iOS and iPadOS has to use WebKit, the bugs don’t just matter for Safari. Third-party browsers are affected too. The risks range from crashes and memory corruption to data leaks, code execution, sandbox escape, and data exfiltration.

Apple also pushed iOS 18.7.10 and iPadOS 18.7.10 for older devices. Those updates patch more than 120 bugs in total, based on Apple’s security notes, including more than 40 in WebKit. The rest cover areas like the Kernel, ImageIO, Audio, and networking, with issues tied to denial-of-service, private data exposure, code execution, and traffic interception.

Apple says it hasn’t seen any of these flaws used in active attacks. Still, once the security notes are out, unpatched devices get a lot easier to target. If your Mac, iPhone, or iPad can install one of these updates, it’s a good idea to do it.

You can download the updates now from Software Update on your Mac, iPhone, or iPad.