This vulnerability is a use‑after‑free bug affecting Apple’s web rendering engine. When a web page containing maliciously crafted content is processed, incorrect memory cleanup can deallocate memory that is still in use, causing the browser or associated process to crash unexpectedly. The result is a denial of service that interrupts user activity, but no evidence indicates the bug can be exploited for code execution or data theft. The issue was addressed with improved memory management and is fixed in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, and watchOS 26.6.

This flaw affects Apple products under the Safari, iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS families. All versions older than 26.5.2 for Safari, iOS, iPadOS, macOS Tahoe, and 26.6 for tvOS, visionOS, and watchOS contain the vulnerability. The fix is delivered in the corresponding 26.5.2 or 26.6 releases for each platform.

The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of exploitation. The CVSS score of 6.5 denotes moderate severity. Based on the description, it is inferred that the likely attack vector involves delivering malicious content through a web page; any user visiting a compromised site could experience a crash. Although the attack probability is low, the impact of a browser or system process termination warrants prompt remediation.