Description
This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 27. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Published: 2026-08-17
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch
AI Analysis

Impact

A state management flaw in Safari can be triggered when the browser parses maliciously crafted web content, causing the application to crash unexpectedly. This results in a temporary denial of service for the user until Safari or the device is restarted. The issue is fixed by updated state management in newer releases.

Affected Systems

The vulnerability affects Apple Safari and web browsing components on Apple iOS, iPadOS, macOS, and visionOS devices that are running versions prior to the security patches. Specifically, Safari releases before 26.6.1, iOS and iPadOS releases before 18.7.10 and 26.6.1, macOS Tahoe before 26.6.2, and visionOS before 27 are impacted. All earlier builds are also susceptible.

Risk and Exploitability

The CVSS base score of 4.3 classifies the flaw as low severity, while the EPSS score of less than 1 % indicates that exploitation is unlikely in the near term. The issue is not catalogued in CISA's KEV list, and no active exploits are publicly reported. If an attacker hosts a web page containing crafted content that Safari loads, the application may crash, causing a local denial‑of‑service until the user restarts it or the system reboots.

Generated by OpenCVE AI on September 21, 2026 at 07:39 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the latest macOS, iOS, iPadOS, and visionOS updates that include Safari version 26.6.1 or later.
  • Once updates are applied, restart Safari and the device to ensure the fix takes effect.
  • Until patches are available, avoid loading untrusted or unknown web pages that could trigger a crash.
  • Enable automatic software updates on all Apple devices to ensure timely receipt of future security fixes.

Generated by OpenCVE AI on September 21, 2026 at 07:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 14 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Description This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 27. Processing maliciously crafted web content may lead to an unexpected Safari crash.
References

Thu, 27 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Title webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash
Weaknesses CWE-120
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 19 Aug 2026 01:15:00 +0000

Type Values Removed Values Added
First Time appeared Apple ipados
Apple iphone Os
Apple safari
CPEs cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
Vendors & Products Apple ipados
Apple iphone Os
Apple safari

Tue, 18 Aug 2026 20:15:00 +0000

Type Values Removed Values Added
Title Safari Crash from Malicious Web Content

Tue, 18 Aug 2026 18:15:00 +0000

Type Values Removed Values Added
Description This issue was addressed through improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
References

Tue, 18 Aug 2026 17:45:00 +0000

Type Values Removed Values Added
Title Safari Crash from Malicious Web Content

Tue, 18 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Title Safari Crash via Malformed Web Content Leading to Denial of Service
Weaknesses CWE-20

Tue, 18 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-703
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 18 Aug 2026 00:30:00 +0000

Type Values Removed Values Added
Title Safari Crash via Malformed Web Content Leading to Denial of Service
First Time appeared Apple
Apple ios And Ipados
Apple macos
Weaknesses CWE-20
Vendors & Products Apple
Apple ios And Ipados
Apple macos

Mon, 17 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
Description This issue was addressed through improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
References

Subscriptions

Apple Ios And Ipados Ipados Iphone Os Macos Safari
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-09-14T20:51:22.781Z

Reserved: 2026-07-22T00:45:50.324Z

Link: CVE-2026-65351

cve-icon Vulnrichment

Updated: 2026-08-18T13:00:00.844Z

cve-icon NVD

Status : Modified

Published: 2026-08-17T22:17:25.580

Modified: 2026-09-14T21:17:20.147

Link: CVE-2026-65351

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-17T21:31:25Z

Links: CVE-2026-65351 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T07:45:11Z

Weaknesses
  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

  • CWE-703

    Improper Check or Handling of Exceptional Conditions