On May 13, 2026, Apple released Safari 26.5 for macOS Sonoma and macOS Sequoia[1]. The update fixes 21 CVEs in total — 20 in WebKit and 1 in WebRTC — covering Content Security Policy (CSP) bypasses, use-after-free conditions that crash Safari or its content processes, and sensitive-information disclosures[1][2]. The same WebKit fixes had already shipped two days earlier inside macOS Tahoe 26.5 on May 11, so this standalone Safari 26.5 build is aimed squarely at users who have not yet moved to Tahoe[2][3].
Release date, scope, and scale of the fixes
Apple's security release document 127121 lists the publication date of Safari 26.5 as May 13, 2026[1]. The update is offered for macOS Sonoma and macOS Sequoia only; the current macOS Tahoe is not in scope[1]. Tahoe users already received the equivalent WebKit fixes bundled in Tahoe 26.5 (security release 127115), shipped on May 11[3].
In CVE-ID terms, the release closes 21 issues — 20 in WebKit and 1 in WebRTC[1]. 9to5Mac summarizes this standalone Safari rollout as "fixes for 20 WebKit vulnerabilities, as well as a WebRTC issue that could cause an unexpected process crash"[2].
Twenty WebKit fixes — CSP bypasses and use-after-free at the center
In WebKit, Apple first addressed validation issue CVE-2026-43660, which let maliciously crafted web content bypass Content Security Policy enforcement, and CVE-2026-28907, which closed the same class of bug through improved input validation[1]. CVE-2026-28962, which could disclose sensitive user information, was patched via stricter access restrictions, and CVE-2026-28958, which let an app access sensitive user data, was addressed with improved data protection[1].
A Safari-crash issue addressed by improved memory handling lands as CVE-2026-43658, while a cluster of nine memory-handling fixes — CVE-2026-28905, CVE-2026-28847, CVE-2026-28904, CVE-2026-28955, CVE-2026-28903, CVE-2026-28953, CVE-2026-28902, CVE-2026-28901, and CVE-2026-28913 — closes process-crash conditions in WebKit's content processes[1]. Two more process-crash items round this out: a use-after-free, CVE-2026-28883, and an input-validation issue, CVE-2026-28917[1]. Three additional use-after-free fixes for Safari crashes — CVE-2026-28947, CVE-2026-28946, and CVE-2026-28942 — also ship in this release, and CVE-2026-28971, a UI-handling fix, blocks a scenario in which a malicious iframe could borrow another site's download settings[1].
WebRTC and Anthropic's involvement
In WebRTC, CVE-2026-28944, which could let maliciously crafted web content trigger an unexpected process crash, was addressed by improved memory handling[1]. Apple credits Kenneth Hsu of Palo Alto Networks and other researchers for the report[1].
One notable line in the credits: the use-after-free fix CVE-2026-28942 in WebKit is attributed to "Milad Nasr and Nicholas Carlini with Claude, Anthropic" — the same wording Apple used in the equivalent iOS 26.5 and macOS Tahoe 26.5 advisories on May 11[1][3]. The explicit acknowledgement that Anthropic researchers used Claude to surface the bug carries over into this standalone Safari build.
Summary
Safari 26.5 adds no new user-facing features. It is a security-focused update that closes 21 CVEs across WebKit and WebRTC, and it serves as the bridge that delivers Tahoe 26.5's WebKit fixes to users still running Sonoma or Sequoia. Updating to 26.5 via System Settings → Software Update is recommended without delay.
Source:[1] https://support.apple.com/en-us/127121
Source:[3] https://support.apple.com/en-us/127115
