The vulnerability is a use‑after‑free bug in WebKit’s memory management that allows an attacker to craft malicious web content. When the browser renders such content, the compromised process crashes unexpectedly, causing a local denial of service. The flaw is mitigated by applying the latest software updates; there is no evidence of remote code execution or privilege escalation.

Apple’s Safari browser and the WebKit engine are vulnerable on macOS, iOS, iPadOS, tvOS, visionOS, and watchOS devices running versions prior to 26.5.2 for Safari, iOS, and iPadOS, 26.5.2 for macOS Tahoe, and 26.6 for tvOS, visionOS, and watchOS. The security update that removes the flaw is available in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, and watchOS 26.6. Devices with earlier releases or other macOS versions that have not been patched remain susceptible.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score is < 1%, indicating a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, and no remote code execution vector is described. Attackers are likely to deliver malicious content via a normal web page or other Internet‑accessible resource; no privileged access or user interaction beyond visiting the content is required. The exploitation requires that the target device render the crafted page, causing a crash that cuts short the browsing session. Overall, the risk level is moderate, with a moderate likelihood of exploitation if attackers target popular sites that can embed the vulnerable payload.