A use‑after‑free error in Apple’s browsers and operating systems can cause an unexpected crash when processing maliciously crafted web content. The flaw does not give an attacker direct code execution or data exfiltration; its primary consequence is a denial of service by terminating the renderer or related processes, potentially disrupting user activity.

The vulnerability affects Apple Safari, iOS, iPadOS, and macOS Tahoe. Versions prior to 26.5.2 are susceptible. The fix is incorporated in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2.

The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, indicating no current widespread exploitation. The attack vector is likely via malicious web content viewed in Safari or other affected browsers, requiring the victim to load the crafted page. The lack of a remote code execution path lowers the severity, but the crash impact can still be disruptive. Regular updates mitigate the risk.