Submit finding

All findings

CVE-2026-64784 + 8 more high

Apple credits Codex Security on nine September WebKit CVEs

Apple directly names OpenAI Codex Security on nine WebKit and Safari memory-safety vulnerabilities added to its September security records.

Bug class
Memory corruption, out-of-bounds access, and browser-process crashes
Affected codebase
Apple WebKit and Safari
Credited system
OpenAI Aardvark / Codex Security
Disclosed
September 14, 2026
Attribution
Direct source attribution
Severity
high
Source status: Apple directly credits OpenAI Codex Security on nine exact CVEs. Entries repeated across Safari and platform advisories are counted once.

Summary

The nine-CVE WebKit set covers memory corruption, out-of-bounds access, and Safari or content-process crashes. Several credits were appended to the older Safari 26.6.1 page on September 14 and repeat in the visionOS 27 advisory. The ledger follows the identifiers rather than multiplying them by product page.

References

Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.