The vulnerability stems from insecure memory handling during the processing of web content in Safari, iOS, iPadOS, and macOS. Maliciously crafted pages can trigger a crash, effectively denying service to the user. This flaw is consistent with memory corruption mechanisms such as buffer copy or use‑after‑free errors, which are categorized as CWEs related to unsanitized memory use.

Apple publishes that Safari on macOS, the Safari browsers on iOS and iPadOS, and macOS Tahoe are affected. All versions prior to 26.5.2 are vulnerable. Users running Safari 26.5.1 or older, iOS 26.5.1 or older, iPadOS 26.5.1 or older, or macOS Tahoe 26.5.1 or older may experience crashes when rendering malicious web content.

The CVSS score of 6.5 and the EPSS metric is unavailable, so the precise exploitation probability is uncertain. However, the flaw can be exploited remotely by simply loading a crafted web page, allowing an attacker to target any visitor. The vulnerability is not listed in the CISA KEV catalog and no public exploit is known; the primary risk remains a denial‑of‑service through application crashes.