This vulnerability originates from unsafe memory handling while parsing specially crafted web content. When the WebKit rendering engine processes such content, the renderer can crash, terminating the browser or auxiliary web process. Because the crash causes a denial‑of‑service, there is no direct avenue for code execution or privilege escalation.

Affected Apple products include Safari, iOS, iPadOS, macOS, and visionOS. Versions prior to Safari 26.2, iOS 18.7.3, iPadOS 18.7.3, macOS 26.2, and visionOS 26.2 are vulnerable. The issue is fixed in the specified releases and later.

The CVSS score of 4.3 classifies the flaw as low severity. The EPSS score is reported as < 1 %, meaning the likelihood of exploitation is very low. The vulnerability is not listed in the CISA KEV catalog and no active exploits are documented. Based on the description, the likely attack vector involves delivering malicious web content to a user’s Safari or other WebKit‑based browsing context, so user interaction or phishing is required. Given the data, the risk is low but applying the vendor‑supplied updates is recommended.