This vulnerability is a use‑after‑free bug affecting Apple’s web rendering engine. When a web page containing maliciously crafted content is processed, improper memory cleanup can deallocate memory that is still in use, causing the browser or associated process to crash unexpectedly. The result is a denial of service that interrupts user activity, but there is no evidence that the bug can be exploited for code execution or data theft. The issue was addressed with improved memory management and is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, and watchOS 26.6.

This flaw affects Apple products running Safari, iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS. All versions older than 26.5.2 for Safari, iOS, iPadOS, and macOS Tahoe, and older than 26.6 for tvOS, visionOS, and watchOS contain the vulnerability. Furthermore, iOS 18.7.10 and iPadOS 18.7.10 also include the fix, with the corresponding 26.5.2 or 26.6 releases for each platform providing the update.

The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of exploitation. The CVSS score of 6.5 denotes moderate severity. Based on the description, it is inferred that the likely attack vector involves delivering malicious content through a web page; any user visiting a compromised site could experience a crash. Although the attack probability is low, the impact of a browser or system process termination warrants prompt remediation.