Description

This issue was addressed through improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-17T22:17:24.547Z",
  "pubdate": "2026-08-17T22:17:24.547Z",
  "executiveSummary": "This vulnerability involves a denial of service condition affecting the Safari web browsing component across multiple Apple operating system environments.\nThe primary impact of successful exploitation is an unexpected crash of the Safari application, disrupting user operations and potentially causing loss of unsaved session data.\nAffected systems include iOS and iPadOS versions 18.7.10 and 26.6.1, as well as macOS Tahoe version 26.6.2.\nThe risk implications are primarily availability-focused, stemming from application instability caused by improper state handling during content processing.\nAn attacker must successfully induce a user to process maliciously crafted web content, such as visiting a compromised or attacker-controlled website.\nNo specific authentication or elevated privileges are required by the attacker beyond the capability to deliver malicious web content to the targeted browser instance.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate state management within the web content processing engine of Safari.\nWhen the affected component parses and evaluates maliciously crafted web content, unexpected memory states or invalid transitions occur, leading to unhandled exceptions or fatal application termination.\nThe attack flow begins when a victim navigates to a web resource serving the specially crafted payload via network protocols.\nThe browser engine processes the payload, triggering the flawed state management logic.\nDue to the absence of proper bounds checking, error handling, or state validation, the execution flow encounters an invalid state, resulting in an immediate crash of the Safari process.\nThe vulnerable component resides within the web content rendering and processing pipeline of the affected software versions.\nAffected versions specifically include iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, and macOS Tahoe 26.6.2.\nExploitation does not require authentication or local privilege access, operating entirely through remote network exposure where the victim interacts with untrusted web content.\nThe payload behavior is focused strictly on triggering the denial of service condition rather than arbitrary code execution or persistence, resulting in application termination and loss of availability."
}