A memory corruption flaw in Safari was identified, where processing maliciously crafted web content triggers an unexpected crash of the browser. The vulnerability results in an application failure rather than arbitrary code execution, making its primary impact a denial of service. Apple addressed the problem with improved state management in version 26.6, which fixes the issue for Safari and its underlying web engine.

The flaw affects Safari and its core web rendering components on macOS, iOS, iPadOS, visionOS, and watchOS. Devices running any of these platforms with versions earlier than 26.6 are vulnerable. Apple has released simultaneous fixes: Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6, and watchOS 26.6.

The EPSS score is < 1%, indicating a very low likelihood of exploitation. No public exploitation data is known and the flaw is not listed in the CISA KEV catalog. The attack vector is inferred to be a remote attacker delivering malicious web content that renders in Safari. Because the flaw leads only to a crash, exploitation risk is limited to denial of service and there are no known mechanisms for code execution or persistent compromise. The vulnerability therefore represents a moderate risk that can be mitigated by upgrading to the fixed releases.