CVE-2026-20676

Overview

Advisory: Apple Security Advisory

Impact:

Description: A website may be able to track users through Safari web extensions

Researchers: Tom Van Goethem

Attribute	Value
CVE	CVE-2026-20676
Bugzilla	305020
Component	WebCore
Bug Class	LogicError
Severity	medium
Commit	0f4832ce0eea25af…
Advisory	Apple Advisory

Root Cause Analysis

This issue was addressed through improved state management.

Files Changed

Source Files

• Source/WebCore/xml/XMLSerializer.cpp

Test Files

• Tools/TestWebKitAPI/Tests/WebKitCocoa/WKWebViewConfiguration.mm