A use‑after‑free flaw in WebKitGTK’s memory handling allows attackers to trigger arbitrary code execution when a target processes specially crafted web content. The vulnerability is rooted in improper deallocation, which is categorized under CWE‑416 and related to CWE‑825 because the freed memory can be accessed again, leading to code execution at the attacker’s choice. An attacker who forces a victim’s browser or web‑view component to load maliciously crafted input can gain full control over the affected process.

Apple’s Safari browser, and all Apple operating systems that ship the WebKitGTK component—iOS, iPadOS, macOS, tvOS, visionOS, and watchOS—are impacted. The vulnerability is fixed in Safari 26.2; iOS 18.7.3 and iPadOS 18.7.3; iOS 26.2 and iPadOS 26.2; macOS Tahoe 26.2; tvOS 26.2; visionOS 26.2; and watchOS 26.2. Any device running an earlier version of these products remains vulnerable.

The CVSS score of 8.8 classifies the flaw in the medium‑high range, and the EPSS score indicates a very low exploit probability (<1%). However, the vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog, confirming that it has been leveraged in a highly targeted, sophisticated attack. The likely attack vector involves delivering malicious web content via an in‑browser or web‑view context, making the flaw exploitable in routine browsing or within malicious web applications.