The vulnerability is a use‑after‑free condition that occurs when Apple WebKit processes maliciously crafted web content. The flaw arises from improper memory management, allowing an attacker to trigger an unexpected termination of the process handling the content. While this results in a denial‑of‑service type impact by crashing the affected application, it does not grant an attacker code execution or elevated privileges.

Apple devices running Safari, iOS, iPadOS, or macOS are affected. The issue is fixed in Safari 26.6.1, iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2; all older releases remain vulnerable.

The measured CVSS score is 6.5, and the EPSS score is < 1%. The vulnerability is not listed in CISA KEV. The attack vector is inferred to be through malicious web content—e.g., pages served over HTTP/HTTPS or embedded in a web view—indicating that the threat originates from content accessed by users. Exploitation could be automated but would likely be limited to triggering application crashes rather than gaining further foothold on the system.