Description
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Published: 2026-06-29
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a use‑after‑free issue addressed by improved memory management. Processing maliciously crafted web content may lead to an unexpected Safari crash, resulting in a denial of service that terminates the browser on the affected device. This disruption does not expose sensitive data. The flaw, classified as CWE‑416, is fixed in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, visionOS 26.6, and watchOS 26.6.

Affected Systems

The vulnerability is present in Apple Safari, iOS, iPadOS, macOS Tahoe, visionOS, and watchOS on all releases prior to the respective patched versions. The fix is deployed in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, visionOS 26.6, and watchOS 26.6, so only older releases are at risk.

Risk and Exploitability

The attack requires that a user loads malicious web content in Safari. Based on the description, the likely vector is remote through a compromised or intentionally malicious website, and the exploited condition is local to the user's device. A very low EPSS score of 0.00326 indicates a low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 6.5 reflects medium severity.

Generated by OpenCVE AI on August 4, 2026 at 08:17 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Safari to version 26.5.2 or newer on all macOS devices.
  • Upgrade iOS and iPadOS to version 26.5.2 or newer on all devices.
  • Upgrade macOS to version Tahoe 26.5.2 or newer.
  • Upgrade visionOS to version 26.6 or newer on all devices.
  • Upgrade watchOS to version 26.6 or newer on all devices.
  • Until the update is installed, avoid browsing untrusted websites or opening unknown links.

Generated by OpenCVE AI on August 4, 2026 at 08:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6398-1 webkit2gtk security update
History

Mon, 27 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Description A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.
References

Fri, 17 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Title webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 30 Jun 2026 03:15:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios And Ipados
Apple macos
Apple safari
Vendors & Products Apple
Apple ios And Ipados
Apple macos
Apple safari

Tue, 30 Jun 2026 00:15:00 +0000

Type Values Removed Values Added
Title Safari Crash via Use-After-Free

Mon, 29 Jun 2026 22:30:00 +0000

Type Values Removed Values Added
Title Safari Crash via Use-After-Free
Weaknesses CWE-416
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 29 Jun 2026 20:15:00 +0000

Type Values Removed Values Added
Description A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
References

Subscriptions

Apple Ios And Ipados Macos Safari
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-07-27T20:13:43.674Z

Reserved: 2026-05-01T22:46:21.645Z

Link: CVE-2026-43727

cve-icon Vulnrichment

Updated: 2026-06-29T21:32:52.978Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-10T00:00:00Z

Links: CVE-2026-43727 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T08:30:05Z

Weaknesses