Description
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected process crash.
Published: 2026-06-29
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Processing maliciously crafted web content may lead to an unexpected crash of Safari, iOS, iPadOS, macOS, tvOS, visionOS, or watchOS, resulting in an availability loss for the affected application or system. The underlying flaw is a memory handling bug that does not compromise confidentiality or integrity, limiting the impact to service disruption on the affected platform.

Affected Systems

The defect is present in Apple’s Safari browser, iOS, iPadOS, and macOS Tahoe before version 26.5.2. The fixes are incorporated in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, and watchOS 26.6, which all contain improved memory handling for web content.

Risk and Exploitability

EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low exploitation probability. However, a typical attack would involve a remote actor delivering malicious web content to a user’s browser, making the exploitation vector likely remote over HTTP(S). The CVSS score of 6.5 indicates moderate risk.

Generated by OpenCVE AI on August 17, 2026 at 22:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Safari to version 26.5.2 or later, or later iOS/iPadOS releases that include the memory handling fix.
  • If an immediate software update is not feasible, use web-filtering or parental‑control solutions to block sites serving malicious content until the update is applied.
  • For macOS Tahoe users, consider upgrading to a newer macOS release that supersedes version 26.5.2 to maintain ongoing support and security patches.

Generated by OpenCVE AI on August 17, 2026 at 22:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6398-1 webkit2gtk security update
History

Mon, 17 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
Description The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected process crash. The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected process crash.
References

Mon, 27 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Description The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an unexpected process crash. The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected process crash.
References

Fri, 17 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Title Safari and iOS memory handling flaw causing application crash webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 30 Jun 2026 03:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios And Ipados
Apple macos
Apple safari
Vendors & Products Apple
Apple ios And Ipados
Apple macos
Apple safari

Tue, 30 Jun 2026 02:00:00 +0000

Type Values Removed Values Added
Title Safari and iOS memory handling flaw causing application crash

Tue, 30 Jun 2026 00:15:00 +0000

Type Values Removed Values Added
Title Safari, iOS, iPadOS, and macOS Process Crash from Malicious Web Content
Weaknesses CWE-122
CWE-788

Mon, 29 Jun 2026 22:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119
CWE-416
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 29 Jun 2026 21:45:00 +0000

Type Values Removed Values Added
Title Safari, iOS, iPadOS, and macOS Process Crash from Malicious Web Content
Weaknesses CWE-122
CWE-788

Mon, 29 Jun 2026 20:15:00 +0000

Type Values Removed Values Added
Description The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an unexpected process crash.
References

Subscriptions

Apple Ios And Ipados Ipados Iphone Os Macos Safari
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-08-17T21:31:02.192Z

Reserved: 2026-05-01T22:46:21.639Z

Link: CVE-2026-43663

cve-icon Vulnrichment

Updated: 2026-06-29T21:48:08.808Z

cve-icon NVD

Status : Modified

Published: 2026-06-29T20:17:34.773

Modified: 2026-08-17T22:17:06.260

Link: CVE-2026-43663

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-10T00:00:00Z

Links: CVE-2026-43663 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-17T22:30:04Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-416

    Use After Free