The vulnerability is caused by unsafe memory handling in the WebKit rendering engine, which can be triggered when the browser processes maliciously crafted web content. The flaw manifests as buffer overflows, use‑after‑free, or read/write violations (CWE‑119, CWE‑120, CWE‑416, CWE‑787), resulting in an unexpected process crash. No evidence from the input indicates code execution or data disclosure; the primary effect is a loss of service for the affected process.

Apple products that incorporate the WebKit engine—Safari on macOS and visionOS, and Safari on iOS and iPadOS—are vulnerable when they run versions prior to Safari 26.3, iOS 18.7.5 / iPadOS 18.7.5 (and any 26.3‑series release), macOS Tahoe 26.3, and visionOS 26.3. Each of those platforms lists a fixed version that resolves the crash.

The CVSS score of 6.5 indicates medium severity, while the EPSS score of <1% suggests a very low likelihood of current exploitation. The vulnerability is not listed in the KEV catalog. The likely attack vector, inferred from the fact that the crash occurs when rendering crafted web content, involves a user visiting a malicious or compromised web page that triggers the flaw. The impact is limited to availability; there is no mention of further privilege escalation or data loss. In unattended or automated browsing environments, repeated crashes could constitute a denial‑of‑service threat.