Executive brief
Apple Safari, iOS, and macOS are affected by a memory management vulnerability. An attacker can exploit this by tricking a user into visiting a maliciously crafted website, which may cause the browser or system process to crash. This could disrupt operations or potentially be used as a stepping stone for further unauthorized activity.
Technical details
A use-after-free vulnerability exists in Apple's web processing components across Safari, iOS, iPadOS, and macOS Tahoe. The issue stems from improper memory management when handling web content. A remote attacker can exploit this by enticing a user to process maliciously crafted web content (e.g., visiting a compromised website). Successful exploitation typically results in an unexpected process crash, though use-after-free vulnerabilities can sometimes be leveraged for arbitrary code execution. The issue was addressed in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2 by improving memory management logic.
Affected products
- Apple Safari < 26.5.2
- Apple iOS and iPadOS < 26.5.2
- Apple macOS Tahoe < 26.5.2
Timeline
- 2026-06-29: disclosed
- 2026-06-29: patched
- 2026-06-29: advisory