Vulnerability Spotlight: Apple Safari SVG marker element base Val remote code execution vulnerability

Summary: Marcin Towalski of Cisco Talos discovered a remote code execution vulnerability in Apple Safari's WebKit, specifically in its SVG marker element feature in version 13.0.2. A specially crafted HTML page can overwrite the static SVG marker element using JavaScript, causing a use-after-free, memory corruption and possibly arbitrary code execution, and the user must open the page in Safari to trigger it.
Key Takeaway: Exploitation requires only that a user open a crafted web page in Safari 13.0.2, so the attack surface is the browser session itself rather than anything the user installs or approves. Talos worked with Apple on a fix and published Snort rules 52048 and 52049 for detection.

Read the original at Cisco Talos ↗

Topics: Cloud Security
Related: Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs Cyber Risks · Nov 12, 2026
New Falcon Cloud Security Innovations Secure the Cloud AI Runs On Cyber Risks · Nov 04, 2026
Cloud-Native Security in 2025: Why Runtime Visibility Must Take Center Stage Cyber Risks ·