Description
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. Processing maliciously crafted web content may lead to an unexpected process crash.
Published: 2026-02-11
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via memory corruption leading to process crash
Action: Apply Patch
AI Analysis

Impact

A vulnerability in WebKitGTK permits the processing of specially crafted web content to trigger a memory handling error that results in a process crash. The resulting out‑of‑bounds memory access causes the crashing process to terminate, leading to a temporary denial of service for the user’s browsing session but does not grant the attacker code execution or persistence privileges.

Affected Systems

The flaw affects Apple’s Safari browser and the WebKit-based web‑view components used on iOS, iPadOS, macOS, and visionOS. The issue is fixed in Safari 26.3, iOS 26.3, iPadOS 26.3, macOS Tahoe 26.3, and visionOS 26.3.

Risk and Exploitability

The CVSS score of 6.5 indicates a medium severity vulnerability. The EPSS score is less than 1 %, suggesting that exploitation attempts are unlikely to be prolific at present and the flaw is not listed in the CISA KEV catalog. The likely attack vector is a malicious web page or embedded content served over the network, requiring only that the victim visit the site or view the content. Once triggered, the crash is local to the user’s device and does not expose the system to further compromise.

Generated by OpenCVE AI on April 16, 2026 at 00:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the Apple Security Update that includes Safari 26.3, iOS 26.3, iPadOS 26.3, macOS Tahoe 26.3, and visionOS 26.3
  • Apply browser or system‑level content filters to block untrusted web content as a temporary defense
  • If a timely update is not possible, disable or restrict JavaScript execution for sites that may contain malicious content

Generated by OpenCVE AI on April 16, 2026 at 00:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4528-1 webkit2gtk security update
Debian DSA Debian DSA DSA-6172-1 webkit2gtk security update
History

Thu, 02 Apr 2026 20:30:00 +0000

Type Values Removed Values Added
Description The issue was addressed with improved memory handling. This issue is fixed in iOS 26.3 and iPadOS 26.3, Safari 26.3, macOS Tahoe 26.3, visionOS 26.3. Processing maliciously crafted web content may lead to an unexpected process crash. The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. Processing maliciously crafted web content may lead to an unexpected process crash.

Fri, 20 Mar 2026 00:15:00 +0000

Type Values Removed Values Added
Title webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
Weaknesses CWE-120
References
Metrics threat_severity

None

 threat_severity

Important

Tue, 17 Feb 2026 13:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple ipados
Apple iphone Os
CPEs cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
Vendors & Products Apple ipados
Apple iphone Os

Fri, 13 Feb 2026 21:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 12 Feb 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios And Ipados
Apple macos
Apple safari
Apple visionos
Vendors & Products Apple
Apple ios And Ipados
Apple macos
Apple safari
Apple visionos

Wed, 11 Feb 2026 23:15:00 +0000

Type Values Removed Values Added
Description The issue was addressed with improved memory handling. This issue is fixed in iOS 26.3 and iPadOS 26.3, Safari 26.3, macOS Tahoe 26.3, visionOS 26.3. Processing maliciously crafted web content may lead to an unexpected process crash.
References

Subscriptions

Apple Ios And Ipados Ipados Iphone Os Macos Safari Visionos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-04-02T18:13:24.088Z

Reserved: 2025-11-11T14:43:07.861Z

Link: CVE-2026-20636

cve-icon Vulnrichment

Updated: 2026-02-13T20:04:32.679Z

cve-icon NVD

Status : Modified

Published: 2026-02-11T23:16:06.820

Modified: 2026-04-02T19:21:14.000

Link: CVE-2026-20636

cve-icon Redhat

Severity : Important

Publid Date: 2026-03-18T00:00:00Z

Links: CVE-2026-20636 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-16T01:00:19Z

Weaknesses