A use‑after‑free flaw resides in Safari’s memory‑management code. When a maliciously crafted web page exploits this weakness, an internal pointer is corrupted, causing Safari to crash unexpectedly. The resulting denial of service can terminate the browser on the affected device, disrupting user sessions but not exposing sensitive data. The flaw is classified as CWE‑416.

The vulnerability is present in Apple Safari, iOS, iPadOS, and macOS Tahoe on all releases prior to versions 26.5.2. The fix is deployed in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2, so only older releases are at risk.

The attack requires that a user loads malicious web content in Safari. Based on the description, the likely vector is remote through a compromised or intentionally malicious website, and the exploited condition is local to the user's device. No EPSS score is provided and the vulnerability is not listed in the CISA KEV catalog, indicating a moderate exploitation probability. The CVSS score of 6.5 reflects medium severity.