Description
This issue was addressed through improved state management. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6. Visiting a website may lead to an app denial-of-service.
Published: 2026-07-27
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An improper state management flaw leads to resource exhaustion (CWE-400, CWE-664) when a user visits a specific website. This can cause applications such as Safari and other Apple operating system apps to terminate or become unresponsive, resulting in a denial of service without requiring attacker credentials or operating‑system privileges.

Affected Systems

Apple Safari, iOS, iPadOS, macOS (Tahoe) and visionOS on any versions prior to 26.6. The flaw was addressed in Safari 26.6, iOS 26.6, iPadOS 26.6, macOS 26.6, and visionOS 26.6.

Risk and Exploitability

The EPSS score is less than 1 %, indicating a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 6.5 reflects medium severity. The attack vector is inferred to involve a malicious website that a victim visits; no additional exploitation prerequisites are disclosed.

Generated by OpenCVE AI on August 22, 2026 at 11:03 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Safari, iOS, iPadOS, macOS, and visionOS to version 26.6 or later
  • Enable automatic software updates on all Apple devices to receive future security patches promptly
  • Consider temporarily disabling JavaScript in Safari via Settings > Safari > Advanced > JavaScript to reduce risk until a patch is available

Generated by OpenCVE AI on August 22, 2026 at 11:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6463-1 webkit2gtk security update
Ubuntu USN Ubuntu USN USN-8703-1 WebKitGTK vulnerabilities
History

Fri, 21 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Title State Management Flaw Causes App Denial-of-Service in Safari and Apple Operating Systems webkitgtk: Visiting a website may lead to an app denial-of-service
Weaknesses CWE-664
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 05 Aug 2026 00:00:00 +0000

Type Values Removed Values Added
Title State Management Flaw Causes App Denial-of-Service in Safari and Apple Operating Systems

Tue, 04 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Title Denial‑of‑Service via Improper State Management in Safari and Apple System Applications
Weaknesses CWE-20

Thu, 30 Jul 2026 01:15:00 +0000

Type Values Removed Values Added
Title Denial‑of‑Service via Improper State Management in Safari and Apple System Applications
Weaknesses CWE-20

Tue, 28 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 28 Jul 2026 01:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios And Ipados
Apple macos
Apple safari
Apple visionos
Vendors & Products Apple
Apple ios And Ipados
Apple macos
Apple safari
Apple visionos

Mon, 27 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Description This issue was addressed through improved state management. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6. Visiting a website may lead to an app denial-of-service.
References

Subscriptions

Apple Ios And Ipados Ipados Iphone Os Macos Safari Visionos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-07-28T16:00:41.528Z

Reserved: 2026-05-01T22:46:27.821Z

Link: CVE-2026-43804

cve-icon Vulnrichment

Updated: 2026-07-28T16:00:37.248Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-27T21:17:03.650

Modified: 2026-07-28T18:57:36.970

Link: CVE-2026-43804

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-20T00:00:00Z

Links: CVE-2026-43804 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-22T11:15:04Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-664

    Improper Control of a Resource Through its Lifetime