A flaw in Safari's state management causes an unexpected crash when the browser processes maliciously crafted web content. The crash results in a denial‑of‑service condition that can disrupt user sessions and potentially affect the responsiveness of other applications on the device. The vulnerability is an instance of improper input handling that bypasses expected bounds or validation checks, leading to an unrecoverable error within the browser process.

Affected systems include Apple iOS and iPadOS devices running versions prior to iOS 18.7.10, iPadOS 18.7.10, iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2. The vulnerability is present in Safari integrated with these operating systems. Users must update to the specified patched releases or later to mitigate the issue.

The CVSS score is not provided in the available data, and the EPSS score is not available, meaning the exploitation likelihood is uncertain. Because the impact is a crash of Safari, and no active exploitation evidence is reported, the risk is considered moderate, but organizations relying on heavy web usage should treat it as potentially high. The vulnerability can be exploited by delivering specially crafted web content, such as through a link, an embedded frame, or a malicious website, making it a remote threat that does not require local privileges.