A use‑after‑free flaw in Apple’s Safari, iOS, iPadOS, and macOS memory handling was identified, leading to an unexpected process crash when malicious web content is processed. The flaw is a classic Use After Free weakness, which can be triggered by crafted HTML or JavaScript that causes the browser to free memory prematurely and then access it again. In practice, the attack delivers a denial‑of‑service condition for the affected user, potentially interrupting browsing or app usage and impacting session continuity.

The vulnerability affects Apple Safari, the iOS and iPadOS operating systems, and macOS Tahoe on all versions prior to 26.5.2. Apple’s advisory states that the issue is resolved in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2, implying that older software releases remain vulnerable.

The vulnerability does not provide direct code execution or other high‑impact effects; the primary risk is a denial‑of‑service crash. The EPSS score is not available and the flaw is not listed in CISA’s KEV catalog, indicating no widespread exploitation data. The likely attack vector is exposure to malicious or unknown web content, making user browsing habits a key factor. As the flaw hinges on a use‑after‑free error, basic defensive controls such as keeping software up to date provide sufficient protection.