Apple released macOS Tahoe 26.5 to the public on May 11, 2026[1][2]. The company's security release page lists 79 CVE-identified fixes, with WebKit accounting for 20 entries and the kernel for 9[1]. The update also includes a serious Wi-Fi vulnerability that allows arbitrary code execution with kernel privileges[1].

Release date, supported devices, and scope of fixes

Apple's security release 127115 lists the macOS Tahoe 26.5 ship date as May 11, 2026[1]. The update targets every Mac running macOS Tahoe and is installed through System Settings → Software Update[2]. According to MacRumors, this is the fifth major macOS Tahoe update and arrives seven weeks after macOS Tahoe 26.4[2].

A total of 79 CVE-identified issues were addressed. WebKit leads the list with 20 entries, followed by the kernel with 9, mDNSResponder with 4, and ImageIO with 3[1]. 9to5Mac characterizes the release as a largely maintenance-focused update, with the most visible new feature being a power-control option in Energy preferences for Mac mini, Mac Studio, and iMac that lets users power on or restart their Mac through assistive accessories[3]. The Maps "Suggested Places" addition, the staged rollout of end-to-end encrypted RCS, and the new App Store monthly billing option are shared with iOS 26.5[2][3].

Kernel and Wi-Fi — root escalation and arbitrary kernel code execution

In the kernel, Apple addressed a string of high-severity flaws: CVE-2026-28951, an authorization state-management issue that could let an app gain root privileges; CVE-2026-28972, an out-of-bounds write that allowed kernel memory writes; and CVE-2026-28897, a buffer overflow that let a local user cause unexpected system termination or read kernel memory[1]. On the information-disclosure side, CVE-2026-43654 and CVE-2026-28987 close kernel-state leaks, while CVE-2026-28986 fixes a race condition[1].

Most notable is Wi-Fi CVE-2026-28819, which Apple describes as allowing "an app to execute arbitrary code with kernel privileges"[1]. The related Wi-Fi flaw CVE-2026-28994 plugs a use-after-free that an attacker in a privileged network position could exploit for a denial-of-service via crafted packets — the same fix shipped in iOS 26.5[1]. Two Gatekeeper bypasses were also addressed in the same release: CVE-2026-28954 in malicious disk image handling, and CVE-2026-28914 in ZIP archive handling[1].

Apple's credit field for the kernel integer-overflow fix CVE-2026-28952 explicitly lists "Calif.io in collaboration with Claude and Anthropic Research"[1].

WebKit — 20 entries spanning CSP bypass, use-after-free, and an Anthropic collaboration

WebKit, which underpins Safari and every in-app browser on the Mac, received 20 CVE fixes in this release[1]. The list includes CVE-2026-43660 and CVE-2026-28907, both of which could prevent Content Security Policy from being enforced; CVE-2026-28962, which could disclose sensitive user information; a cluster of use-after-free flaws causing Safari crashes (CVE-2026-28883, CVE-2026-28947, CVE-2026-28946, and others); and CVE-2026-28971, which let a malicious iframe inherit another site's download settings[1].

As with iOS 26.5, Apple credits the WebKit use-after-free fix CVE-2026-28942 to "Milad Nasr and Nicholas Carlini with Claude, Anthropic" — bringing the total Anthropic Research collaborations in macOS Tahoe 26.5 to two when combined with the kernel CVE-2026-28952 credit[1].

Elsewhere, mDNSResponder picked up four fixes, including CVE-2026-43668, a use-after-free that a remote attacker could leverage to corrupt kernel memory[1]. Both StorageKit and UserAccountUpdater received a single fix each that closed paths to root privilege[1].

Summary

macOS Tahoe 26.5 introduces little in the way of public-facing features, but it bundles 79 CVE fixes — among them a Wi-Fi kernel RCE, root escalations in the kernel, StorageKit and UserAccountUpdater, and two Gatekeeper bypasses. Anyone running macOS Tahoe should apply the update promptly.

Source:[1] https://support.apple.com/en-us/127115

Source:[2] https://www.macrumors.com/2026/05/11/apple-releases-macos-tahoe-26-5/

Source:[3] https://9to5mac.com/2026/05/11/macos-26-5-now-available-heres-everything-new/

Source:[4] https://support.apple.com/en-us/100100