Description
This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Published: 2026-08-17
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A weakness in Safari’s state management allows maliciously crafted web content to cause Safari to crash unexpectedly. The flaw stems from improper handling of internal state when processing such content, leading to an abrupt termination of the browser. This crash results in a temporary denial of service, interrupting browsing sessions and potentially requiring a device restart before normal operation resumes. The vulnerability has been addressed in Safari 26.6.1, iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2.

Affected Systems

The vulnerability affects Apple devices running iOS versions prior to 26.6.1, iPadOS versions prior to 26.6.1, and macOS Tahoe versions prior to 26.6.2. All versions of Safari bundled with these operating systems are impacted.

Risk and Exploitability

The vulnerability is exploitable via any web page that includes specially crafted content. The risk is a local denial of service that can be triggered remotely by visiting a malicious site; the CVSS score of 4.3 indicates low severity, and the EPSS score of <1% suggests that exploitation is unlikely. The issue is not listed in CISA’s KEV catalog.

Generated by OpenCVE AI on August 27, 2026 at 02:11 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest operating system updates, which include Safari fixes to address the reported state management issue.
  • Until updates are installed, avoid browsing untrusted or suspicious websites that may contain malicious content designed to trigger the crash.
  • Configure device automatic updates to ensure timely receipt of future security patches.

Generated by OpenCVE AI on August 27, 2026 at 02:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 27 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Title webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash
Weaknesses CWE-120
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 19 Aug 2026 01:15:00 +0000

Type Values Removed Values Added
First Time appeared Apple ipados
Apple iphone Os
Apple safari
CPEs cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
Vendors & Products Apple ipados
Apple iphone Os
Apple safari

Tue, 18 Aug 2026 20:15:00 +0000

Type Values Removed Values Added
Title Safari Crash from Malicious Web Content

Tue, 18 Aug 2026 18:15:00 +0000

Type Values Removed Values Added
Description This issue was addressed through improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
References

Tue, 18 Aug 2026 17:45:00 +0000

Type Values Removed Values Added
Title Safari Crash from Malicious Web Content

Tue, 18 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Title Safari Crash via Malformed Web Content Leading to Denial of Service
Weaknesses CWE-20

Tue, 18 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-703
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 18 Aug 2026 00:30:00 +0000

Type Values Removed Values Added
Title Safari Crash via Malformed Web Content Leading to Denial of Service
First Time appeared Apple
Apple ios And Ipados
Apple macos
Weaknesses CWE-20
Vendors & Products Apple
Apple ios And Ipados
Apple macos

Mon, 17 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
Description This issue was addressed through improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
References

Subscriptions

Apple Ios And Ipados Ipados Iphone Os Macos Safari
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-08-18T17:59:41.773Z

Reserved: 2026-07-22T00:45:50.324Z

Link: CVE-2026-65351

cve-icon Vulnrichment

Updated: 2026-08-18T13:00:00.844Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-17T22:17:25.580

Modified: 2026-08-19T00:58:16.910

Link: CVE-2026-65351

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-17T21:31:25Z

Links: CVE-2026-65351 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-27T02:15:04Z

Weaknesses
  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

  • CWE-703

    Improper Check or Handling of Exceptional Conditions