This vulnerability is a use-after-free issue (CWE-416) in Apple Safari that can be triggered by processing maliciously crafted web content, leading to an unexpected crash of the browser. The flaw was addressed by Apple through improved memory management and fixed in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, and watchOS 26.6. The CVSS v3.1 base score is 6.5, reflecting a network attack vector with low attack complexity, no privileges required, but requiring user interaction. The impact is limited to availability (denial of service) with no confidentiality or integrity impact. There are no known exploits in the wild and no explicit vendor advisory patch status beyond the fixed versions.

Successful exploitation of this vulnerability may cause Apple Safari to crash unexpectedly, resulting in denial of service. There is no impact on confidentiality or integrity of data. The vulnerability requires user interaction and can be triggered remotely via network by processing crafted web content.

A fix is available in Safari version 26.5.2 and corresponding OS versions (iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6). Users and administrators should update affected Safari browsers and operating systems to these versions or later to remediate this vulnerability. Patch status is confirmed by the vendor through fixed version releases.