This vulnerability in Apple Safari involves improper state management when processing maliciously crafted web content, which can lead to an unexpected crash of the browser. The issue affects multiple Apple platforms including Safari on iOS, iPadOS, macOS Tahoe, and visionOS. Apple fixed the issue in Safari version 26.6.1 and related OS versions 18.7.10, 26.6.2, and 27 respectively. The CVSS v3.1 base score is 4.3, reflecting a network attack vector with low complexity, no privileges required, user interaction needed, and impact limited to availability (denial of service).

An attacker can cause Apple Safari to crash by delivering specially crafted web content, resulting in denial of service. There is no impact on confidentiality or integrity. No known exploits are reported in the wild.

Apply the official fixes by updating Safari to version 26.6.1 or later, and update iOS to 18.7.10 or later, iPadOS to 18.7.10 or later, macOS Tahoe to 26.6.2 or later, and visionOS to 27 or later. These updates include improved state management that resolves the issue.