The vulnerability occurs when Safari processes maliciously crafted web content lacking proper input validation. The error can force the browser to crash, causing a denial‑of‑service condition for the user. The crash is confined to the Safari application; it does not directly compromise system files or data, but repeated crashes can impede critical user workflows.

Apple devices running iOS, iPadOS, or macOS versions older than iOS 18.7.10, iPadOS 18.7.10, iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2 are affected. The issue is resolved in iOS 18.7.10, iPadOS 18.7.10, iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2.

No publicly reported CVSS score or EPSS data are available, indicating a lack of detailed severity scoring. The vulnerability is not listed in the CISA KEV catalog, suggesting no large‑scale active exploitation has been documented. The likely attack vector relies on user interaction; a single visit to a crafted web page could trigger the crash. The exploit requires the browser to parse the malicious content, making it a user‑dependent vector.