CVE-2026-20652 is a vulnerability in Apple Safari where a remote attacker may cause a denial-of-service by exploiting improper memory handling. The flaw is fixed in Safari 26.3, iOS 18.7.5, iPadOS 18.7.5, macOS Tahoe 26.3, and visionOS 26.3. The vulnerability is tracked under CWE-400 (Uncontrolled Resource Consumption) and CWE-120 (Classic Buffer Overflow). Red Hat advisories confirm the issue affects webkitgtk4 packages and provide patches for related platforms. The CVSS v3.1 base score is 7.5, indicating high severity, with attack vector network, low attack complexity, no privileges or user interaction required, and impact limited to availability (denial-of-service). No known exploits in the wild have been reported.

Successful exploitation of this vulnerability allows a remote attacker to cause a denial-of-service condition in Safari, potentially crashing the browser or rendering it unusable temporarily. There is no indication of confidentiality or integrity impact. The denial-of-service could disrupt user browsing sessions or automated processes relying on Safari.

This vulnerability is fixed in Safari 26.3 and corresponding OS versions (iOS 18.7.5, iPadOS 18.7.5, macOS Tahoe 26.3, visionOS 26.3). Users and administrators should apply these official updates to remediate the issue. Red Hat has also released patches for webkitgtk4 in their Extended Life Cycle Support 7 distributions. No additional mitigation is required once the official patches are applied.