The vulnerability arises from improper memory handling in macOS’s web content rendering processes. When maliciously crafted web content is processed, the application may unexpectedly crash, leading to a denial of service: the affected process terminates unexpectedly, disrupting user sessions and potentially affecting system stability for web‑based workloads.

Apple’s macOS operating system is affected, specifically the Sequoia release series. The issue was fixed in macOS Sequoia 15.5, so versions prior to 15.5 remain vulnerable. Users running Sequoia 15.0–15.4 or any earlier minor revisions may experience crashes when encountering malformed web content.

The CVSS score of 6.5 indicates a moderate risk level, while the EPSS < 1% points to a very low likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no known large‑scale attacks. Attackers would need to supply specially crafted content that a user’s browser processes, so the feasible attack vector is through malicious web pages or compromised web applications. The official fix in 15.5 corrects the memory handling, eliminating the crash vector once upgraded.