A memory corruption flaw in Safari, iOS, iPadOS, and macOS can be triggered by malicious web content, resulting in a process crash that disrupts browsing and other web‑dependent functions. The vulnerability stems from improper memory handling when parsing crafted pages, leading to an unexpected termination of the renderer. The primary consequence is denial of service for users who load the affected content.

Apple Safari, iOS, iPadOS, and macOS Tahoe are vulnerable when running versions prior to 26.5.2. The bug has been fixed in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2.

The EPSS score is not available and the vulnerability is not listed in CISA KEV, suggesting no known active exploitation. A potential attacker can cause a crash by directing a user to maliciously crafted web content, but no confirmed exploits are documented. Without a CVSS score, the severity cannot be precisely quantified, though the crash capability indicates a high impact on availability.