A stack overflow in Safari triggers when the browser processes maliciously crafted web content, causing an unexpected crash. The vulnerability is a classic stack buffer overflow (CWE‑120) that disrupts the target application by exhausting critical memory, but it does not provide code execution or data exfiltration capabilities. An attacker could force a tragic denial of service on the victim’s device by delivering specially designed page elements that exploit the overflow.

The flaw affects Apple’s Safari web browser on iOS, iPadOS and macOS. The update that fixes the issue is available in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2 and macOS Tahoe 26.5.2. Devices running earlier releases are vulnerable if they have not applied the patch.

The known exploitability is limited to the delivery of malicious web content; no remote code execution or persistence is possible. Because the issue produces a crash, the likelihood of widespread exploitation is tempered by its narrow impact, but the lack of a publicly available exploit means it is not currently a high-PR threat. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that subversive exploitation is not yet observed. Nonetheless, attackers could leverage the crash to disrupt services, making timely patching advisable.