A memory corruption flaw in Safari’s state management can be triggered by maliciously crafted web content, resulting in an unexpected crash of the browser. This impact is limited to denial of service for users who load affected pages; the data from the vulnerability report does not indicate any code execution or data theft.

The vulnerability affects Apple devices running iOS and iPadOS up to versions 18.7.10 and 26.6.1, as well as macOS Tahoe up to version 26.6.2. All listed Apple operating systems prior to these patch releases are considered potentially vulnerable.

No CVSS or EPSS score is provided, and the flaw is not listed in the CISA KEV catalog. The attack path described in the report involves delivering malicious web content to a Safari instance; the attacker would need only ability to host or serve a crafted page that a user accesses. The question mark around exploitation prevalence is raised by the lack of publicly available exploits, but the vector remains plausible based on the described memory corruption.