Description
This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Published: 2026-08-17
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This issue was addressed through improved state management. Processing maliciously crafted web content may lead to an unexpected Safari crash. The vulnerability causes Safari to crash when rendering such content, resulting in a denial of service for users. It is associated with improper state management (CWE‑703) and buffer handling (CWE‑120).

Affected Systems

Apple iOS, iPadOS, and macOS are affected. The fix is included in iOS 18.7.10 and 26.6.1, iPadOS 18.7.10 and 26.6.1, and macOS Tahoe 26.6.2.

Risk and Exploitability

The likely attack vector is delivering maliciously crafted web content to Safari over the internet, which would trigger a crash on the victim’s browser. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 4.3 indicates moderate impact; while the availability disruption is limited to the user session, the risk remains moderate for end‑users.

Generated by OpenCVE AI on August 27, 2026 at 02:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the latest iOS update (18.7.10 or 26.6.1) or iPadOS update (18.7.10 or 26.6.1) on affected devices.
  • Upgrade macOS to Tahoe 26.6.2 to apply the Safari crash fix.
  • Restart Safari or the device if a crash occurs to restore functionality.

Generated by OpenCVE AI on August 27, 2026 at 02:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 27 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Title webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash
Weaknesses CWE-120
References
Metrics threat_severity

None

 threat_severity

Important

Tue, 18 Aug 2026 20:15:00 +0000

Type Values Removed Values Added
Title Safari Crash from Maliciously Crafted Web Content Leading to Denial of Service
First Time appeared Apple ipados
Apple iphone Os
Apple safari
CPEs cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
Vendors & Products Apple ipados
Apple iphone Os
Apple safari

Tue, 18 Aug 2026 18:45:00 +0000

Type Values Removed Values Added
Title Safari Crash from Maliciously Crafted Web Content Leading to Denial of Service

Tue, 18 Aug 2026 18:15:00 +0000

Type Values Removed Values Added
Description This issue was addressed through improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
References

Tue, 18 Aug 2026 15:15:00 +0000

Type Values Removed Values Added
Title Safari Web Content Crash Leading to Denial of Service
Weaknesses CWE-676
CWE-682

Tue, 18 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-703
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 17 Aug 2026 23:45:00 +0000

Type Values Removed Values Added
Title Safari Web Content Crash Leading to Denial of Service
Weaknesses CWE-676
CWE-682

Mon, 17 Aug 2026 23:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios And Ipados
Apple macos
Vendors & Products Apple
Apple ios And Ipados
Apple macos

Mon, 17 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
Description This issue was addressed through improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
References

Subscriptions

Apple Ios And Ipados Ipados Iphone Os Macos Safari
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-08-18T17:59:44.492Z

Reserved: 2026-07-22T00:45:02.635Z

Link: CVE-2026-65331

cve-icon Vulnrichment

Updated: 2026-08-18T12:55:00.491Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-17T22:17:24.040

Modified: 2026-08-18T19:55:58.757

Link: CVE-2026-65331

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-17T21:31:37Z

Links: CVE-2026-65331 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-27T02:45:03Z

Weaknesses
  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

  • CWE-703

    Improper Check or Handling of Exceptional Conditions