Apple has released security updates for more than two dozen security vulnerabilities across iPhone, iPad, and Mac.
The updates for iOS/iPadOS, MacOS Tahoe, and Safari were issued after testing on iOS 26.6 and iPadOS 26.6 betas.
What stands out in the update is that a lot of the vulnerabilities were found in WebKit, the browser engine that powers Safari as well as every browser on iPhone, including Chrome, Firefox, and Edge. It also looks like several of the issues Apple has addressed can be chained together to steal data or run malicious code with little or no user interaction.
Updates for your particular device
The table below shows which updates are available and points you to the relevant security content for that subject.
| Name and link | Available for |
| iOS 26.5.2 and iPadOS 26.5.2 | iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later |
| macOS Tahoe 26.5.2 | macOS Tahoe |
| Safari 26.5.2 | macOS Sonoma and macOS Sequoia |
How to update your Apple devices
How to update your iPhone or iPad
For iOS and iPadOS users, here’s how to check if you’re using the latest software version:
Go to Settings > General > Software Update. You will see if there are updates available and be guided through installing them.
Turn on Automatic Updates if you haven’t already—you’ll find it on the same screen.
How to update macOS on any version
To update macOS on any supported Mac, use the Software Update feature, which Apple designed to work consistently across all recent versions. Here are the steps:
- Click the Apple menu in the upper-left corner of your screen.
- Choose System Settings (or System Preferences on older versions).
- Select General in the sidebar, then click Software Update on the right. On older macOS, just look for Software Update directly.
- Your Mac will check for updates automatically. If updates are available, click Update Now (or Upgrade Now for major new versions) and follow the on-screen instructions. Before you upgrade to macOS Tahoe 26, please read these instructions.
- Enter your administrator password if prompted, then let your Mac finish the update (it might need to restart during this process).
- Make sure your Mac stays plugged in and connected to the internet until the update is done.
How to update your Safari browser
Safari updates are included with macOS updates, so installing the latest version of macOS will also update Safari. To check manually:
- Open the Apple menu > System Settings > General > Software Update.
- If you see a Safari update listed separately, click Update Now to install it.
- Restart your device when prompted.
If you’re on an older macOS version that’s still supported (like Sonoma or Sequoia), Apple may offer Safari updates independently through Software Update.
Technical details
On iPhone and iPad, every browser—Safari, Chrome, Firefox, Edge—is forced to use Apple’s WebKit engine, which is exactly where most of the 26.5.2 fixes land. Apple and independent write‑ups describe a chain of WebKit issues, including use‑after‑free bugs, memory corruption, and cross‑origin logic errors that could be triggered simply by loading a malicious page. In several cases, the impact ranges from crashing your browser to corrupting memory or leaking data from other sites you have open in different tabs.
And there are some other browser related issues. Apple also notes fixes in Web Extensions and permission handling that could have allowed browser extensions or sites to access more data than intended. Plus some that are scattered across related libraries and frameworks such as libxslt, and WebRTC.
Libxslt is an open-source C library used to perform transformations on XML documents. It enables developers to convert raw XML data into other formats, such as HTML, plain text, or other XML structures.
WebRTC (Web Real-Time Communication) is an open-source technology that allows web browsers and mobile apps to communicate directly with each other.
None of the patched vulnerabilities are known to be exploited in the wild, but that doesn’t mean you can relax. One thing to consider when you are scheduling this update is that, due to the beta testing, the details of these vulnerabilities have been public knowledge for a while, so the race to come up with an exploit has already started.
Scammers know more about you than you think.
Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in.