radar

Apple patches iOS and macOS CVEs: fix, then tune your Safari profiles

iOS 26.5 fixes 98 CVEs, including 21 in WebKit; macOS Tahoe 26.5 fixes 98 CVEs, including 22. Instead of enabling Lockdown Mode everywhere, segment with a dedicated Safari profile.

On May 11, Apple released iOS 26.5 and macOS Tahoe 26.5, which fix 98 CVEs on the iOS side (including 21 on WebKit, Safari’s engine) and 98 on the macOS side (including 22 WebKit). You install the patch. And then what? Rather than switching Lockdown Mode on everywhere and breaking half the sites you visit, there’s a finer option, available since iOS 17 and that almost nobody uses: Safari profiles.

Apple Publishes iOS 26.5 and macOS Tahoe 26.5, Fixing 98 CVEs

On May 11, Apple released iOS 26.5 and macOS Tahoe 26.5. These updates address 98 security vulnerabilities on iOS (including 21 on WebKit, Safari’s engine) and 98 on macOS (including 22 WebKit). Several of these vulnerabilities allowed malicious websites to execute code or bypass sandbox protections. As usual with Apple releases, WebKit takes the biggest hit, as it’s the largest attack surface on an iPhone or Mac.

Patch now. That’s a no-brainer. The real question is, what do you do between patches, when clicking on mail links, conducting sensitive searches, or logging into online banking?

Why Lockdown Mode All the Time is Too Much

Lockdown Mode is robust. MacSouverain praised it in article 29. It’s perfect for journalists, dissidents, or lawyers handling sensitive cases.

But for freelancers or small businesses just checking email, doing online accounting, or watching recipes, it’s overkill. Disabled JIT JavaScript, cut Safari extensions, restricted media formats, filtered Messages attachments. Too much friction, too many websites breaking. The usual result: you enable it for a few days, find it annoying, disable it, and end up with nothing.

What are Safari Profiles?

Since iOS 17 and macOS Sonoma (September 2023), Safari supports multiple profiles within the same app. It’s been quiet, never highlighted in keynotes. Most people you talk to don’t know it exists.

Each profile has its own history, cookies, enabled extensions, search engine, favorites, and tab groups. No mixing: Google’s session cookie from your “Personal” profile isn’t seen by your “Sensitive” profile. Privacy extensions active on “Sensitive” don’t slow down “Personal” navigation. Switch in two taps (tap on tabs on iPhone, Safari menu on Mac), syncs with iCloud between Mac and iPhone.

It’s the usage segmentation we’ve advised for years in security, without installing a second browser.

What to Do Now

1. Install iOS 26.5 and macOS Tahoe 26.5. Settings, General, Software Update. Twenty minutes, including restart.

2. Create a “Sensitive” Safari profile. On Mac: Safari, menu, Create Profile. On iPhone: Settings, Apps, Safari, Profiles, New Profile. Name, icon, color.

3. Configure the “Sensitive” profile: DuckDuckGo or Qwant search engine (setting per profile), empty favorites, and add two or three privacy extensions active only on this profile: AdGuard for Safari (free on App Store, network and cosmetic filtering), Vinegar if you want a clean YouTube (one-time purchase), StopTheMadness Pro if you already have its license. Your default profile remains untouched, no slowdown when surfing normally.

4. What the profile doesn’t isolate: advanced Safari settings (block all cookies, disable JavaScript, tracking block) are global, applying to all profiles. If you want to toughen these toggles, do it globally in Settings, Apps, Safari, knowing it’ll affect your default profile too.

When to Switch to the “Sensitive” Profile

Clicking on a link from an unknown sender. Medical or legal research. Bank or broker login. ProtonMail on the web from a less-used device. Any site you’re unsure about and don’t want to cookie your main profile with. Two taps, switch, do what you need to do, switch back.

Usage segmentation, not global hardening. Keep your comfort on your default profile, have a “clean navigation” mode on hand.

What It Doesn’t Replace

Safari profiles aren’t Lockdown Mode. JIT JavaScript remains active on all profiles. If you’re a journalist handling sensitive sources, a lawyer on a sensitive case, a dissident, or if you’ve received an Apple threat notification, use global Lockdown Mode. Safari profiles are a tool for daily use, not state actor protection.

Basic hygiene doesn’t change: patch (iOS 26.5 now), don’t open unexpected attachments, verify URLs before entering passwords.

MacSouverain