Description

The issue was addressed with improved checks. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-17T22:17:22.977Z",
  "pubdate": "2026-08-17T22:17:22.977Z",
  "executiveSummary": "A denial of service vulnerability exists within Safari across multiple Apple operating systems, specifically involving the processing of maliciously crafted web content.\nThe vulnerability allows remote threat actors to trigger an unexpected application crash of the Safari browser upon parsing adversarial inputs.\nAffected products include iOS, iPadOS, and macOS across specified versions.\nThe risk implication is restricted to a localized availability disruption of the browser component, interrupting user sessions and degrading overall system reliability.\nAttackers require the capability to deliver crafted web content to a targeted user, typically via malicious websites or compromised web traffic.\nNo specific authentication or elevated privileges are required by the attacker to induce the crash condition, relying solely on the victim processing the anomalous web payload.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input validation and error handling logic during the parsing and rendering of web content within the Safari browser engine.\nWhen the application encounters a maliciously crafted web content payload that violates expected structural or syntactic constraints, the internal checks fail to gracefully handle the malformed data.\nThe lack of robust boundary validation and exception handling leads to memory corruption anomalies, null pointer dereferences, or assertion failures, which immediately force the termination of the process.\nThe attack flow proceeds as follows: First, the user navigates to an attacker-controlled web page or encounters malicious web content injected via a compromised third-party resource or man-in-the-middle vector.\nSecond, the Safari browser fetches and begins processing the Hypertext Markup Language, cascading style sheets, scripts, or associated media components contained within the payload.\nThird, the vulnerable component attempts to process the anomalous elements without adequate defensive validation checks.\nFourth, the internal parsing engine encounters the structural anomaly, triggering an unhandled exception or fatal error condition that causes Safari to crash unexpectedly, denying service to the user.\nThe vulnerable component is centralized within the web content processing and rendering engine of Safari.\nAffected versions include iOS 18.7.10, iPadOS 18.7.10, iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2.\nExploitation does not require prior authentication or local system privileges, operating entirely over standard network vectors where web traffic is ingested by the client application."
}