Description

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-17T22:17:11.560Z",
  "pubdate": "2026-08-17T22:17:11.560Z",
  "executiveSummary": "A memory handling vulnerability exists in Safari affecting multiple Apple operating systems, specifically iOS 18.7.10, iPadOS 18.7.10, iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2. The flaw allows processing of maliciously crafted web content to trigger an unexpected application crash, resulting in a localized denial of service for the web browser. The root cause stems from improper memory management within the affected component when parsing or rendering specific types of web payloads. The risk implication is primarily availability disruption, impacting user experience and potentially interrupting critical browser sessions. Attacker capabilities are constrained to causing application instability through remote content delivery. Exploitation requirements involve enticing a targeted user to process malicious web content, typically via browsing a compromised website or viewing untrusted web resources, without requiring prior authentication or elevated privileges.",
  "technicalDetails": "The vulnerability resides within the memory handling subsystems of Safari, specifically concerning how the browser processes complex or maliciously crafted web content. The root cause is characterized by suboptimal memory management, which fails to securely allocate, reference, or deallocate resources when encountering specific structures or malformed inputs within web pages. The vulnerable component is exposed to untrusted network traffic via standard web browsing protocols, requiring no authentication or local privilege escalation from an attacker.\nThe step-by-step attack flow begins when an adversary crafts a malicious web payload designed to exploit the memory handling flaw. The attacker then exposes the victim to this content, such as by hosting it on a malicious or compromised web server and directing the user to navigate via Safari. Upon processing the maliciously crafted web content, the browser's parsing and rendering engine encounters anomalous memory states that trigger corruption or invalid memory access patterns. Because the application lacks sufficient bounds checking or safe memory reclamation routines for these specific inputs, an exception or fatal error occurs.\nConsequently, this anomalous behavior leads directly to an unexpected Safari crash, disrupting the user session and resulting in a denial of service for the browser application. Post-exploitation impact is strictly limited to application termination and does not inherently provide remote code execution or unauthorized data access based on the provided description. Affected versions comprise iOS 18.7.10, iPadOS 18.7.10, iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2, all of which require remediation via vendor-supplied updates."
}