This vulnerability is a use‑after‑free defect in Apple’s web rendering engine that causes Safari to crash when processing specially crafted web content. The flaw does not allow execution of arbitrary code or compromise of data; the primary consequence is a loss of service for the impacted user with a brief interruption. The weakness is identified by CWE‑416, a classic memory‑management error.

Apple’s Safari, iOS, iPadOS and macOS Tahoe versions current before 26.5.2 are affected. The issue is remedied by upgrading to Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2 or macOS Tahoe 26.5.2. Once these updates are applied, the use‑after‑free condition is eliminated.

The CVSS score is not provided in the advisory, and the EPSS score is unavailable; the vulnerability is not listed in CISA’s KEV catalog. Because the attack requires delivery of malicious web content to a Safari session, the implied attack vector is remote via a web page. While the exploitability is not quantified, the potential for user interruption means that the risk is higher than a purely informational flaw. Updating to the patched versions removes the risk entirely.