CVE-2026-20665

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may prevent Content Security Policy from being enforced

Researchers: webb

Attribute	Value
CVE	CVE-2026-20665
Bugzilla	304951
Component	WebCore
Bug Class	LogicError
Severity	medium
Commit	b4390e8352b7dc2e…
Advisory	Apple Advisory

Root Cause Analysis

This issue was addressed through improved state management.

Files Changed

Source Files

• Source/WebCore/loader/DocumentWriter.cpp

Test Files

• LayoutTests/http/tests/security/contentSecurityPolicy/iframe-srcdoc-import-bypass-expected.txt
• LayoutTests/http/tests/security/contentSecurityPolicy/iframe-srcdoc-import-bypass.html
• LayoutTests/http/tests/security/contentSecurityPolicy/resources/module-pass.py
• LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/inheritance-from-initiator.sub-expected.txt