This vulnerability is an out‑of‑bounds access that can be triggered by maliciously crafted web content, resulting in an unexpected crash of the browser or system process. The flaw does not provide a path to execute arbitrary code, but it can interrupt services and cause denial of service for users interacting with affected web pages.

Apple Safari, iOS, iPadOS and macOS (Tahoe). Versions prior to Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2 and macOS Tahoe 26.5.2 are vulnerable; the issue is fixed in those releases.

The exploit requires an attacker to serve or embed malicious content that is processed by the affected product, a remote attack vector but requiring no elevated privileges. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Absent a CVSS score, the impact is limited to process crashes, yet the potential for widespread disruption depends on the scale of affected devices.