This vulnerability (CVE-2026-20635) affects Apple Safari and is caused by improper memory handling when processing maliciously crafted web content, leading to unexpected process crashes. The issue is addressed by Apple in Safari 26.3 and corresponding OS versions including iOS 18.7.5, iPadOS 18.7.5, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, and watchOS 26.3. The CVSS v3.1 base score is 4.3, indicating medium severity, with attack vector network, low attack complexity, no privileges required, user interaction required, and impact limited to availability (process crash). Red Hat advisories confirm the issue and provide patches for affected webkitgtk4 packages in Red Hat Enterprise Linux 7 Extended Lifecycle Support. The vulnerability is fixed by improved memory handling to prevent crashes.

The vulnerability can cause an unexpected process crash in Safari when processing maliciously crafted web content, resulting in denial of service (availability impact). There is no impact on confidentiality or integrity. No known exploits are reported in the wild. The issue affects user experience by causing browser instability or crashes.

A fix is available from Apple in Safari 26.3 and corresponding OS updates (iOS 18.7.5, iPadOS 18.7.5, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26.3). Users and administrators should update to these versions to remediate the vulnerability. Red Hat has also released security updates for webkitgtk4 packages addressing this issue for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Applying these vendor-provided patches is the recommended mitigation. No additional action is required beyond applying the official fixes.