A race condition in WebKitGTK’s handling of web content can cause the rendering process to crash when the browser is fed maliciously crafted data. The crash results in a denial of service that affects the availability of the affected application or system, but it does not directly compromise confidentiality or integrity. The weakness is categorized as a concurrency error (CWE-362).

Apple’s Safari browser and the underlying WebKitGTK engine on macOS, iOS, iPadOS, tvOS, visionOS, and watchOS are affected. The issue was fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, and watchOS 26.2. Systems running any earlier version of these products are vulnerable.

The CVSS score of 3.1 denotes a low overall severity, and the EPSS score of less than 1% indicates a very low expected exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote and content‑based; an attacker can supply malicious content to a user’s browser to trigger the crash. Because the flaw does not grant code execution or persistence, the risk is limited to disrupting availability of the affected processes. Nonetheless, applying the vendor’s patch remains the recommended countermeasure.