The vulnerability is triggered by improper memory handling within WebKitGTK, causing maliciously crafted web content to crash the browser process. The primary impact is a denial of service at the user level, as the affected application terminates unexpectedly when loading the problematic content. This weakness corresponds to CWE‑119, where out‑of‑bounds memory accesses can lead to process failures.

Affected systems include all Apple web viewing environments that use WebKitGTK: Safari on macOS, Safari on iOS and iPadOS devices, and the corresponding web engines in tvOS, visionOS, and watchOS. The issue is fixed in Safari 26.1, iOS 26.1, iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, and watchOS 26.1. All earlier releases of these products are potentially vulnerable.

The CVSS score of 4.3 indicates low severity, and the EPSS score of less than 1% suggests a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed active exploits in the wild. The attack vector is inferred to be via a malicious web page loaded in a WebKitGTK‑based browser, where the contained malformed content triggers a memory error that crashes the process. Users are advised to mitigate by updating to the patched versions.