This vulnerability involves a use-after-free condition in Apple Safari that can be triggered by a malicious web extension, resulting in an unexpected process crash. The issue was resolved by Apple through improved memory management in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, and watchOS 26.6. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or integrity impact, and high availability impact.

A malicious web extension could cause Safari to crash unexpectedly due to a use-after-free vulnerability, leading to denial of service for the user. There is no indication of confidentiality or integrity compromise. No known exploits are reported in the wild.

Apply the official fix by updating Safari and the corresponding Apple operating systems to version 26.5.2 or later (including iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS). This update includes improved memory management that resolves the use-after-free issue. No other mitigation is indicated.