A use‑after‑free flaw was addressed by improving memory management, but maliciously crafted web content can still trigger a crash in Safari. The vulnerability does not allow attackers to execute code or disclose data; it merely disrupts user sessions by terminating the browser process.

Apple's Safari, iOS, iPadOS, and macOS (Tahoe) versions prior to 26.5.2 are affected. The issue is fixed in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2 and later. Users running earlier releases remain vulnerable.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of 0.00544 indicates a very low exploitation probability, and the vulnerability is not listed in CISA KEV, so no confirmed exploitation has been reported in the wild. The attack vector is inferred to be the delivery of crafted web content to a user’s browser; once the page loads, the use-after-free condition can be triggered, resulting in a crash. Given the lack of a publicly known exploit and the limited scope to the browser, the overall risk is moderate.