A flaw in Apple’s memory handling for web content processing can cause an unexpected crash of the Safari, iOS, iPadOS, or macOS Tahoe process. An attacker who serves specially crafted web pages could trigger this condition, resulting in a denial of service where the affected application or system becomes unavailable. No direct impact on confidentiality or integrity is described, and the vulnerability is limited to service disruption on the affected platform.

The defect is present in Apple’s Safari browser, iOS, iPadOS, and macOS Tahoe before version 26.5.2. The fixes are incorporated in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2, which all contain improved memory handling for web content.

EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower publicly observed exploitation probability. However, a typical attack would involve a remote actor delivering malicious web content to a user’s browser, making the exploitation vector likely remote over HTTP(S). The CVSS score is not disclosed, but the impact of a crash indicates that the risk to availability is significant.