Safari on Sonoma and Sequoia still needs 26.6.1

Safari is the tab Mail still opens on a Mac that never installed Chrome. On 18 August 2026 Apple shipped Safari 26.6.1 for macOS Sonoma and macOS Sequoia. The notes say a crafted page can crash Safari or corrupt memory, and one history bug can leak data. This is not the Screen Sharing operating-system patch from earlier in August, and it is not a Tahoe installer. If the Mac is still on Sonoma or Sequoia, Software Update is the click.

Overview

What broke

On 18 August 2026 Apple released Safari 26.6.1. The security notes on About the security content of Safari 26.6.1 were dated 20 August. Apple’s own sentence is the scope: this update delivers security fixes that were first made available in the macOS Golden Gate 27 beta. Every row on that page is listed for macOS Sonoma and macOS Sequoia only.

Two of the rows matter on a home Mac. CVE-2026-65341 is WebKit. Apple’s impact line: processing maliciously crafted web content may lead to memory corruption. They addressed it with improved memory handling. Memory corruption is a write that lands in the wrong place.

CVE-2026-64778 is WebKit History. Visiting a maliciously crafted website may leak sensitive data. They addressed it with improved checks. History is where you have already been. A leak there is a URL or a token you thought stayed in the browser.

The same 26.6.1 click also closes a stack of other WebKit crash and memory-corruption rows. Apple’s wording on those is an unexpected Safari crash, an unexpected process crash, unexpected process termination, or memory corruption. One click covers the set. Apple has not said any of these are being used in the wild. CISA has not listed 65341 or 64778 on the Known Exploited Vulnerabilities catalog. The updater is already in Software Update.

Who is in range

You, if the Mac is on Sonoma or Sequoia and About Safari still reads below 26.6.1. The front-desk iMac. The laptop in the bag. The till Mac that only opens a booking page. Mail that still hands links to Safari.

Updating Chrome does not patch Safari. They do not share an installer. Firefox and Edge are separate clicks. Tahoe, Apple’s macOS 26 line, is not on this standalone Safari package. Safari on Tahoe rides the operating-system updater. If that Mac is already current, this brief is not yours. Windows does not run this Safari. An iPhone-only household is on a different train. Phone Safari comes with iOS.

What the vendor shipped

• Safari 26.6.1, released 18 August 2026, for macOS Sonoma and macOS Sequoia. Apple’s notes were published 20 August.
• The same WebKit work first showed up in the macOS Golden Gate 27 beta. This package is how Sonoma and Sequoia get it without a whole new OS.
• The path is Apple menu, System Settings, General, Software Update. Safari menu, About Safari, is how you confirm the number. Some builds also offer the updater from that window.

On Sonoma and Sequoia, Safari 26.6.1 is its own line in Software Update. It is not a full macOS bump. About This Mac can stay on 14 or 15. About Safari is the line that must read 26.6.1. Do not hunt this installer on a Tahoe Mac.

What this is not

• Not the Screen Sharing hole. That bug is CVE-2026-65400 on the macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9 operating-system train. Different product. Different click.
• Not an iPhone Safari update. Phone Safari rides iOS. This Mac package does not close the phone.
• Not a claim that a page can run code on the Mac. Apple said crash, memory corruption, and a history leak.
• Not on CISA KEV. Apple has not said these are in the wild. The patch is out.
• Not patched by updating Chrome, Firefox, or Edge. Not done if About Safari still reads below 26.6.1.

The patch is out. Software Update is already in System Settings. That is the cheap window.

Who can skip

• About Safari already shows 26.6.1 on every Sonoma or Sequoia Mac you click.
• Tahoe, macOS 26, already current on the operating-system updater. This standalone Safari package is not listed for that line.
• Windows-only. This Safari does not run there.
• iPhone-only, and no Sonoma or Sequoia Mac in the house still below 26.6.1. Phone Safari is a different train.
• A Mac too old for Sonoma. Apple did not list this package there.
• A shop Mac frozen by MDM still needs 26.6.1. That is an IT push, not a skip for the fleet.

Why it matters

Safari holds the session you already logged into when you never installed another browser: Mail links, iCloud tabs, the password door for the bank, the shop admin console. A crash knocks that process over while the session is live. Memory corruption is Apple’s phrase for bytes landing next door. The history leak is the one that can expose a URL you thought stayed inside the browser.

These bugs look like a page. You do not download a special file. You click a link in Mail, open a booking site, or land on a page that got a bad script. WebKit is the engine behind that tab. That is why a visit is enough, and why “I only use Safari for one site” is still in range.

Apple did not put an exploited flag on these CVEs. CISA has not added 65341 or 64778 to KEV. Waiting is still how a browser patch sits in Software Update for a week while Mail keeps handing you links. This is not the Screen Sharing KEV from the OS train. Do not mix the two. Take the Safari line on Sonoma and Sequoia. Stay current on Tahoe with the system updater. Leave the iPhone to its own Settings pane.

A shop that images Macs once a quarter is the other half of in range. The machine that “only opens one site” still launches Safari. Chrome’s About number does not move this one. One stale Safari is enough.

The bottom line

On this Mac

1. Click the Apple menu in the top-left corner. Choose System Settings. On older wording it may still say System Preferences. Same door.
2. In the left sidebar, click General. Then click Software Update. Stay on that pane. The Mac will check on its own.
3. If it offers Safari 26.6.1, click Update Now. Enter your Mac password if it asks. Let it finish. Do not close the lid in the middle. Plug in power if the battery is low.
4. Restart if the pane asks. Sign back in. Click the Safari menu in the menu bar. That is the word Safari next to the Apple menu, not a webpage. Choose About Safari.
5. Read the version line. You want Safari 26.6.1. If the number is still below 26.6.1, go back to Software Update and stay there.

What you should see

On Sonoma and Sequoia, Software Update names Safari 26.6.1 as its own line. It is not a full macOS bump. About This Mac can stay on 14.x or 15.x. That is expected. About Safari is the line that must move. Under the Safari heading it should read 26.6.1. Trust that window, not a splash after restart, and not Chrome’s About tab.

If Software Update will not move

Stay on a network you already trust. A cafe captive portal can stall the download at 0%. Plug in power. A Mac that is about to sleep will pause the installer. If the pane sits on Checking, quit System Settings from the menu bar, reopen it, and go back to General, Software Update. You can also open Safari, click the Safari menu, then About Safari, and take the updater if that window offers 26.6.1. Do not download a “Safari updater” from a random site. Apple’s own Software Update pane is the installer.

A shop Mac managed by MDM or a “do not update” catalog will not self-update. Ask whoever owns the image to push Safari 26.6.1 on Sonoma and Sequoia. Same build, different delivery. Do not type a Chrome version into that request. Do not ask for the Screen Sharing OS build by mistake. The line is Safari 26.6.1.

The other Mac, the phone, and when you are done

1. The laptop in the bag, the iMac at the front desk, the till Mac that only opens a booking page: same Apple menu path tonight. One stale Safari is enough.
2. iPhone or iPad: Settings, General, Software Update. That is the iOS train, not this Safari 26.6.1 package. Take it for the phone. It does not close the Mac, and this Mac click does not close the phone.
3. A Tahoe Mac: Apple menu, System Settings, General, Software Update for the operating system. Do not look for this standalone Safari 26.6.1 installer there.
4. Windows: skip. Chrome, Firefox, or Edge: each one’s own About or updater. Safari 26.6.1 is not their number.

You are done when About Safari reads 26.6.1 on every Sonoma or Sequoia Mac you click, and the installer has finished once. You do not need to clear history, sign out of iCloud, or wipe anything. You needed a new Safari build. You have it.