The vulnerability is a use‑after‑free in Apple WebKit that is triggered when processing maliciously crafted web content. Improved memory management was applied to fix it; the patch restores stability and is available in Safari 26.6.1, iOS 18.7.10, iOS 26.6.1, iPadOS 18.7.10, iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, and watchOS 27. Prior to the fix, an attacker could cause the content‑processing process to terminate unexpectedly, resulting in denial‑of‑service.

Apple devices running Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are affected. The issue is fixed in Safari 26.6.1, iOS 18.7.10, iOS 26.6.1, iPadOS 18.7.10, iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, and watchOS 27; all older releases remain vulnerable.

The measured CVSS score is 6.5, and the EPSS score is < 1%. The vulnerability is not listed in CISA KEV. The attack vector is inferred to be through malicious web content—e.g., pages served over HTTP/HTTPS or embedded in a web view—indicating that the threat originates from content accessed by users. Exploitation could be automated but would likely be limited to triggering application crashes rather than gaining further foothold on the system.