Executive brief
Apple Safari, iOS, and macOS are affected by a security flaw that occurs when processing web content. An attacker could create a malicious website that, when visited, causes memory corruption on the user's device. This could potentially lead to system instability or unauthorized code execution, compromising personal data and device security.
Technical details
A type confusion vulnerability exists in the way Safari, iOS, iPadOS, and macOS process web content. The issue stems from insufficient type checks during content rendering or script execution. A remote attacker can exploit this by enticing a user to visit a specially crafted website, leading to memory corruption. This corruption can potentially be leveraged for arbitrary code execution within the context of the browser or operating system. Apple has addressed the issue by implementing improved type checks in Safari 26.5.2, iOS/iPadOS 26.5.2, and macOS Tahoe 26.5.2.
Affected products
- Apple Safari < 26.5.2
- Apple iOS and iPadOS < 26.5.2
- Apple macOS Tahoe < 26.5.2
Timeline
- 2026-06-29: disclosed
- 2026-06-29: patched