Description

This issue was addressed through improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-17T22:17:24.430Z",
  "pubdate": "2026-08-17T22:17:24.430Z",
  "executiveSummary": "This vulnerability involves a denial of service condition affecting Safari when processing maliciously crafted web content, resulting in an unexpected application crash.\nThe flaw affects multiple Apple operating systems and versions, specifically iOS 18.7.10, iPadOS 18.7.10, iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2.\nThe root cause stems from improper internal state management within the browser engine when parsing untrusted or maliciously crafted web resources.\nAn attacker possessing the capability to deliver malicious web content—such as via a compromised website or a crafted hyperlink—can trigger this vulnerability without requiring authentication or elevated privileges.\nSuccessful exploitation directly impacts system availability by forcing an abrupt termination of the Safari web browser, disrupting user workflows and potentially causing localized resource exhaustion.\nThe primary operational risk is service disruption, although attackers might chain such denial of service conditions with other vectors if applicable, though the direct manifestation described is strictly application instability.",
  "technicalDetails": "The vulnerability resides within the state management subsystem of the Safari browser engine responsible for rendering and processing web content.\nWhen Safari parses maliciously crafted web content containing specific structural anomalies or unexpected sequences of data, the state machine fails to handle transitions or memory states correctly.\nThe root cause is traced to inadequate state validation and exception handling, which allows unexpected inputs to push the application logic into an invalid or unhandled execution state.\nTo initiate the attack flow, an adversary must entice a victim to navigate to a web page hosting the malicious content, or inject the payload via a compromised intermediary site.\nUpon loading the resource, the browser's rendering engine attempts to process the crafted elements, causing internal invariants to fail.\nThis invariant violation triggers an immediate defensive panic or an unhandled segmentation fault, leading to an unexpected application crash of Safari.\nThe vulnerability does not inherently require authentication or elevated privileges from the attacker perspective, as web content is natively processed in a standard user context.\nNetwork exposure is inherent to any browser processing external network traffic, making remote exploitation via standard HTTP/HTTPS protocols entirely feasible.\nThe immediate post-exploitation impact is limited to a denial of service of the Safari application instance, forcing the browser to close abruptly and terminating active user browsing sessions."
}