Description
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an unexpected process crash.
Published: 2026-06-29
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability is a use‑after‑free bug in Apple's web browsers and operating systems. A crafted web page can trigger accidental deallocation of memory that is still in use, causing the browser or related process to crash. The immediate consequence is a denial of service that disrupts user activity; there is no known escalation to code execution or data exfiltration.

Affected Systems

The flaw affects Apple products announced under the Safari, iOS, iPadOS, and macOS Tahoe families. Versions prior to 26.5.2 of each product contain the vulnerability. The fix is delivered in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2.

Risk and Exploitability

No EPSS score is available and the vulnerability is not included in CISA’s KEV catalog, suggesting limited or no evidence of active exploitation. The CVSS score is 6.5, indicating moderate severity. Nevertheless, the attack vector involves delivering malicious content through a web page, meaning any user visiting a compromised site could experience a crash. The lack of a current exploit makes the risk moderate, but the impact of a browser or system process termination warrants prompt remediation.

Generated by OpenCVE AI on June 29, 2026 at 23:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Safari, iOS, iPadOS, and macOS to version 26.5.2 or later.
  • Enable automatic software updates to ensure timely receipt of patches.
  • Avoid visiting known malicious or untrusted websites until an update has been applied.

Generated by OpenCVE AI on June 29, 2026 at 23:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 17 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Title webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 30 Jun 2026 03:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios And Ipados
Apple macos
Apple safari
Vendors & Products Apple
Apple ios And Ipados
Apple macos
Apple safari

Mon, 29 Jun 2026 23:45:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free Leading to Process Crash in Apple Browsers and OS

Mon, 29 Jun 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 29 Jun 2026 21:45:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free Leading to Process Crash in Apple Browsers and OS
Weaknesses CWE-416

Mon, 29 Jun 2026 20:15:00 +0000

Type Values Removed Values Added
Description A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an unexpected process crash.
References

Subscriptions

Apple Ios And Ipados Macos Safari
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-06-29T21:37:21.158Z

Reserved: 2026-05-01T22:46:21.643Z

Link: CVE-2026-43699

cve-icon Vulnrichment

Updated: 2026-06-29T21:37:12.368Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-10T00:00:00Z

Links: CVE-2026-43699 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-06-30T03:45:07Z

Weaknesses