CVE-2026-20676

Description

This issue was addressed through improved state management. This issue is fixed in Safari 26.3, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. A website may be able to track users through Safari web extensions.

How to fix CVE-2026-20676

To remediate CVE-2026-20676, upgrade the affected package to a fixed version below.

• Bitnami/java—upgrade to 1.8.0 or later
• Bitnami/java-min—upgrade to 1.8.0 or later
• —upgrade to 1.8.0 or later
• —upgrade to 2.50.6-1~deb11u1 or later
• —no fix listed

Is CVE-2026-20676 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (5)

• from 0, < 1.8.0, >= 1.9.0, < 8.0.491
• from 0, < 1.8.0, >= 1.9.0, < 8.0.491
• from 0, < 1.8.0, >= 1.9.0, < 8.0.491
• from 0, < 2.50.6-1~deb11u1
• from 0

CVSS scores

References (6)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2026-20676
• WEBnvd.nist.gov/vuln/detail/CVE-2026-20676
• WEBsupport.apple.com/en-us/126346
• WEBsupport.apple.com/en-us/126348
• WEBsupport.apple.com/en-us/126353