In the WebKitGTK engine, parsing maliciously constructed web content can trigger an unexpected crash, resulting in a denial‑of‑service condition. The failure mode is a local crash of the rendering process, which may affect the stability and availability of the user’s browsing experience but does not directly disclose data or allow arbitrary code execution. The weakness is classified as CWE‑20 (Improper Input Validation).

Apple products are affected, including Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The issue is fixed in Safari 26.1, iOS 18.7.2 and 26.1, iPadOS 18.7.2 and 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, and watchOS 26.1. Users running versions older than those releases are vulnerable.

The CVSS score of 4.3 indicates a moderate severity, and the EPSS score of less than 1% suggests low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require delivery of crafted web content to a vulnerable WebKitGTK instance, which may occur whenever a vulnerable browser renders untrusted web pages. Because of the crash‑only nature, the impact is limited to service disruption rather than privilege escalation or data loss.