The vulnerability is a use‑after‑free bug in WebKit’s memory management. When maliciously crafted web content is processed, the affected process can crash unexpectedly, resulting in a local denial of service. The flaw was fixed in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, and watchOS 26.6. No evidence indicates remote code execution or privilege escalation.

Apple’s Safari browser and the WebKit engine are vulnerable on macOS, iOS, iPadOS, tvOS, visionOS, and watchOS devices running versions prior to 26.5.2 for Safari, iOS, and iPadOS, 26.5.2 for macOS Tahoe, and 26.6 for tvOS, visionOS, and watchOS. The security update that removes the flaw is available in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, and watchOS 26.6. Devices with earlier releases or other macOS versions that have not been patched remain susceptible.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score is < 1%, indicating a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, and no remote code execution vector is described. Attackers are likely to deliver malicious content via a normal web page or other Internet‑accessible resource; no privileged access or user interaction beyond visiting the content is required. The exploitation requires that the target device render the crafted page, causing a crash that cuts short the browsing session. Overall, the risk level is moderate, with a moderate likelihood of exploitation if attackers target popular sites that can embed the vulnerable payload.