A use‑after‑free flaw in Safari’s memory handling can be triggered by maliciously crafted web content, causing Safari to crash unexpectedly. The vulnerability does not provide an attacker with code execution or data disclosure; it simply disrupts the browsing experience by terminating the browser process.

Apple’s Safari, iOS, iPadOS, and macOS (Tahoe) versions prior to 26.5.2 are affected. The issue is fixed in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2 and later. Users running earlier releases remain vulnerable.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, so no confirmed exploitation has been reported in the wild. The attack vector is inferred to be the delivery of crafted web content to a user’s browser; once the page loads, the use‑after‑free condition can be triggered, resulting in a crash. Given the lack of a publicly known exploit and the limited scope to the browser, the overall risk is moderate.