A logic flaw in Apple Safari and macOS allows maliciously crafted web content to trigger an unexpected crash, resulting in a denial of service that impacts the user session and application stability. The issue leads to a controlled failure rather than arbitrary code execution, but it can be leveraged by attackers to disrupt user experience and potentially interrupt critical services that rely on Safari. The vulnerability is identified as CWE‑703, indicating an insecure implementation of logic checks.

Apple Safari browsers older than version 18.6 and macOS releases before Sequoia 15.6 are susceptible. The update to Safari 18.6 and macOS Sequoia 15.6 contains the necessary logic fixes that prevent the crash.

The CVSS score of 6.5 assigns this flaw a moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. Apple has not listed this vulnerability in the CISA KEV catalog, indicating no known public exploitation. Attackers would most likely need to entice users to visit a crafted webpage or deliver malicious HTML, so the primary attack vector is remote via the internet. Successful exploitation results in application termination and a brief treatment of denial of service rather than a compromise of the operating system.