A use‑after‑free flaw in Apple Safari's memory management has been fixed in the 26.5.2 releases. When maliciously crafted web content is processed, the browser crashes instead of executing arbitrary code; the crash isolates the fault to the Safari process, preventing compromise of system files but disrupting the user session and potentially affecting other applications on the device.

Apple Safari, iOS, iPadOS and macOS Tahoe are affected by releases prior to 26.5.2. The vulnerability is resolved in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2 and macOS Tahoe 26.5.2.

EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The flaw can be triggered through malicious web content, implying an attack vector that relies on a web page served over a network. The exploitation results in a browser crash, thereby denying service to the user session. Because the crash does not lead to code execution or data exfiltration, risks to confidentiality or integrity are limited; the primary impact is loss of availability for browsing activities. The CVSS score of 6.5 indicates moderate risk.