The vulnerability arises from insufficient input validation when processing crafted web content in Safari. An attacker could supply maliciously structured data that causes Safari to crash, resulting in denial of service for the user. The crash does not compromise data or access rights but renders the browser unusable until the device is restarted or updated.

Apple’s mobile operating systems iOS and iPadOS, and the macOS Tahoe platform are affected. The flaw was fixed in iOS 18.7.10, iPadOS 18.7.10, iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2.

The CEV AS does not have an EPSS score disclosed and is not listed in CISA’s KEV catalog, indicating no publicly known exploits at the time of this assessment. Given the crash consequence, the CVSS severity reflects a high impact on availability. Exploitation would require the victim to load malicious content in Safari, making it a user‑centric threat vector. The absence of exploit proof or KEV listing reduces the immediate threat level but patching remains the recommended mitigation.